4 ms·

I like to fool around those unwanted requests, sending back a randomly selected response among which: a gzip bomb, an xml bomb, specify gzip content encoding bu

I like to fool around those unwanted requests, sending back a randomly selected response among which: a gzip bomb, an xml bomb, specify gzip content encoding but send WAZAAAA in clear text instead, a redirect to localhost, redirect to their own public IP, sending back data whose content-length don't match what they're actually getting and a bunch of other shenanigans. The code is available on github [1], I'm super keen to add a bunch of other fun payload if someone has some clever ideas (without going onto a redirect to fbi, cia or anything that could cause more issues than what it's worth) [1] https://github.com/mickael-kerjean/filestash/blob/master/server/plugin/plg_security_scanner/index.go#L198-L217 https://github.com/mickael-kerjean/filestash/blob/master/ser...

mmcgaha 4y ago
I think I love you mickael-kerjean.
gingerlime 4y ago
this is neat. I wonder how to combine it with fail2ban / nginx. That said, from a practical perspective, I wonder if "boring" consistent responses might be better, not to encourage attackers to keep trying? (plus false-positive might be costly)
justsomehnguy 4y ago
> without going onto a redirect to fbi Redirect to FSB then. But the more real one would be sending something what could be executed on their side, ie some JavaScript or maybe PHP. Most of the time it's nothign to gain there (because compromised machines or VM/jail/container) but still can be interesting, like finding out the real IP of the first machine or attempting to grab the cookies. Maybe even shellcode to get the AS info and send a note to abuse@.
- quesera 4y ago
  I sometimes redirect obviously-hostile requests to localhost. E.g. http://localhost/../../../../../etc/passwd http://localhost/../../../../../etc/passwd I know it has zero effect, but it's more fun than a 404.
yabones 4y ago
A fun and easy one for Nginx is to simply redirect all requests by default. I stick this in my default vhost after the healthcheck and error page parts :) location / { return 301 http://$remote_addr$request_uri; access_log /var/log/nginx/spam.log; } This also helps to separate the useless garbage requests from the real ones to keep the logs clean. 99% of the time scanners are hitting your IP rather than your hostname, so it's pretty safe to just ignore their requests entirely.
BoppreH 4y ago
Oohh, that's a nice exercise. A few more ideas that should be easy to implement: - Content-Type: application/json, and body {"response"꞉ "success"} (hint: that's not an ASCII colon). - Content-Type: application/json, and body [[[[[...]]]]] nested ten thousand times. - Redirect to their own public IP, and at a random common port. - Redirect to their own public IP in dotless hexadecimal notation (ping 172.217.23.110 -> ping 0xacd9176e). - From[1], redirect to http://example.com/;'$(gt=$(perl$IFS-E$IFS's//62/;s/62/chr/e;say');eval$IFS''cowsay$IFS''pwned$IFS$gt/dev/tty)';cowsay$IFS''pwned (or instead of "cowsay" run "cat" to block their script) - Pick a header, then insert one from [EICAR test string[2], \x00, \n] somewhere in the middle. - Or just add a "Server:" header with a random line from the Big List of Naughty Strings[3]. - Redirect to a normal URL, but with a trailing dot in the domain name[4], like "example.com.". It's valid, but you'd be surprised how many things it breaks. - Nested content encoding with "Content-Encoding: gzip, gzip, gzip, gzip, ...", with a random depth. The n-1 payload is "WAZAAAA". - "Content-Type: image/jpeg" and "Content‑Encoding: gzip" with a valid gzip body... But the ‑ in "Content‑Encoding" is U+2011 NON-BREAKING HYPHEN. - "Content-Type: image/jpeg" and "Content-Language: en-US\u000bContent‑Encoding: gzip" with a valid gzip body, where \u000b is a vertical tab. - Spin the wheel of HTTP status codes! res.WriteHeader(rand.Intn(1000)) - Infinite loop sending a 100 (Continue) every five seconds (they might have a timeout for the TCP and TLS handshakes, and even a timeout for the next TCP segment... But did they remember to set a timeout for receiving the HTTP body?). Watch out for running out of connections. [1] https://github.com/jwilk/url.sh https://github.com/jwilk/url.sh [2] https://en.wikipedia.org/wiki/EICAR_test_file https://en.wikipedia.org/wiki/EICAR_test_file [3] https://github.com/minimaxir/big-list-of-naughty-strings https://github.com/minimaxir/big-list-of-naughty-strings [4] https://en.wikipedia.org/wiki/Fully_qualified_domain_name https://en.wikipedia.org/wiki/Fully_qualified_domain_name
deleted 4y ago
[deleted]
tejtm 4y ago
endless rick rolling is always appreciated

mmcgaha 4y ago

I think I love you mickael-kerjean.

gingerlime 4y ago

this is neat. I wonder how to combine it with fail2ban / nginx. That said, from a practical perspective, I wonder if "boring" consistent responses might be better, not to encourage attackers to keep trying? (plus false-positive might be costly)

justsomehnguy 4y ago

> without going onto a redirect to fbi Redirect to FSB then. But the more real one would be sending something what could be executed on their side, ie some JavaScript or maybe PHP. Most of the time it's nothign to gain there (because compromised machines or VM/jail/container) but still can be interesting, like finding out the real IP of the first machine or attempting to grab the cookies. Maybe even shellcode to get the AS info and send a note to abuse@.

quesera 4y ago
I sometimes redirect obviously-hostile requests to localhost. E.g. http://localhost/../../../../../etc/passwd http://localhost/../../../../../etc/passwd I know it has zero effect, but it's more fun than a 404.

yabones 4y ago

A fun and easy one for Nginx is to simply redirect all requests by default. I stick this in my default vhost after the healthcheck and error page parts :) location / { return 301 http://$remote_addr$request_uri; access_log /var/log/nginx/spam.log; } This also helps to separate the useless garbage requests from the real ones to keep the logs clean. 99% of the time scanners are hitting your IP rather than your hostname, so it's pretty safe to just ignore their requests entirely.

BoppreH 4y ago

Oohh, that's a nice exercise. A few more ideas that should be easy to implement: - Content-Type: application/json, and body {"response"꞉ "success"} (hint: that's not an ASCII colon). - Content-Type: application/json, and body [[[[[...]]]]] nested ten thousand times. - Redirect to their own public IP, and at a random common port. - Redirect to their own public IP in dotless hexadecimal notation (ping 172.217.23.110 -> ping 0xacd9176e). - From[1], redirect to http://example.com/;'$(gt=$(perl$IFS-E$IFS's//62/;s/62/chr/e;say');eval$IFS''cowsay$IFS''pwned$IFS$gt/dev/tty)';cowsay$IFS''pwned (or instead of "cowsay" run "cat" to block their script) - Pick a header, then insert one from [EICAR test string[2], \x00, \n] somewhere in the middle. - Or just add a "Server:" header with a random line from the Big List of Naughty Strings[3]. - Redirect to a normal URL, but with a trailing dot in the domain name[4], like "example.com.". It's valid, but you'd be surprised how many things it breaks. - Nested content encoding with "Content-Encoding: gzip, gzip, gzip, gzip, ...", with a random depth. The n-1 payload is "WAZAAAA". - "Content-Type: image/jpeg" and "Content‑Encoding: gzip" with a valid gzip body... But the ‑ in "Content‑Encoding" is U+2011 NON-BREAKING HYPHEN. - "Content-Type: image/jpeg" and "Content-Language: en-US\u000bContent‑Encoding: gzip" with a valid gzip body, where \u000b is a vertical tab. - Spin the wheel of HTTP status codes! res.WriteHeader(rand.Intn(1000)) - Infinite loop sending a 100 (Continue) every five seconds (they might have a timeout for the TCP and TLS handshakes, and even a timeout for the next TCP segment... But did they remember to set a timeout for receiving the HTTP body?). Watch out for running out of connections. [1] https://github.com/jwilk/url.sh https://github.com/jwilk/url.sh [2] https://en.wikipedia.org/wiki/EICAR_test_file https://en.wikipedia.org/wiki/EICAR_test_file [3] https://github.com/minimaxir/big-list-of-naughty-strings https://github.com/minimaxir/big-list-of-naughty-strings [4] https://en.wikipedia.org/wiki/Fully_qualified_domain_name https://en.wikipedia.org/wiki/Fully_qualified_domain_name

deleted 4y ago

[deleted]

tejtm 4y ago

endless rick rolling is always appreciated