4 ms·

I wonder why the author uses a 404 error response. I usually configure NGINX with "return 444;" which closes the connection without response. Scanners don't des

I wonder why the author uses a 404 error response. I usually configure NGINX with "return 444;" which closes the connection without response. Scanners don't deserve a response. I may have wasted bytes receiving the request, but I won't waste any more once I know the request is garbage.

yabones 4y ago
That was mostly just for the blog post. In reality my default vhost 301's back to the IP that sent the request. I doubt it ever does anything, but I like to think it makes hackers attack themselves in the confusion :p I also have a fake /admin path that just contains a bunch of offensive/illegal phrases in 10 ish languages, but it was out of character for the post. 444 is a good idea though, I didn't know about that response code!
fluential 4y ago
You will like this more elaborate attacks you can do to those bots https://www.hackerfactor.com/blog/index.php?/archives/762-Attacked-Over-Tor.html https://www.hackerfactor.com/blog/index.php?/archives/762-At...
- justin_oaks 4y ago
  Good read, thanks. For others who aren't interested in reading the whole thing: The author of the post used zip-bombs, which are compressed HTTP responses that expand to 1000 times the size of the compressed data. He could send relatively small responses that would fill the requester's memory and crash the process. Beautiful.
jcynix 4y ago
I use "402 Payment Required“ right now, which is sent to the client. Didn't know about 444, which isn't listed on the Wikipedia page about HTTP return codes ...
- jonas-w 4y ago
  It is listed on wikipedia, but under "Unofficial Codes -> nginx" as it is nginx specific and not standardized.
quesera 4y ago
Beware though -- nginx 444 doesn't actually close the connection. At the packet level, it just does not respond. This distinction is important if you have a load balancer in front of nginx. The LB will wait until timeout for a response, occupying a bit of stateful memory and probably causing an error which is indistinguishable from "backend application server is offline".
- treffer 4y ago
  That is actually cool, it is a tarpit for these bots! On a well configured site the LB timeouts should be short enough anyway. But it is a risk, especially on classic DOS attacks.
  - quesera 4y ago
    Yep it's great for tarpitting if you are not behind an LB. The other problem, if you are behind an LB, is that the client (DoS attacker) will get a 503 from the LB after timeout. So, no gain even if your timeouts are reasonable. It'd be great if you could return a custom response from nginx that would tell the LB to drop the request -- or you could move the exploit-detection logic to the LB instead of nginx, and the LB could do its own 444 equivalent.

yabones 4y ago

That was mostly just for the blog post. In reality my default vhost 301's back to the IP that sent the request. I doubt it ever does anything, but I like to think it makes hackers attack themselves in the confusion :p I also have a fake /admin path that just contains a bunch of offensive/illegal phrases in 10 ish languages, but it was out of character for the post. 444 is a good idea though, I didn't know about that response code!

fluential 4y ago

You will like this more elaborate attacks you can do to those bots https://www.hackerfactor.com/blog/index.php?/archives/762-Attacked-Over-Tor.html https://www.hackerfactor.com/blog/index.php?/archives/762-At...

justin_oaks 4y ago
Good read, thanks. For others who aren't interested in reading the whole thing: The author of the post used zip-bombs, which are compressed HTTP responses that expand to 1000 times the size of the compressed data. He could send relatively small responses that would fill the requester's memory and crash the process. Beautiful.

jcynix 4y ago

I use "402 Payment Required“ right now, which is sent to the client. Didn't know about 444, which isn't listed on the Wikipedia page about HTTP return codes ...

jonas-w 4y ago
It is listed on wikipedia, but under "Unofficial Codes -> nginx" as it is nginx specific and not standardized.

quesera 4y ago

Beware though -- nginx 444 doesn't actually close the connection. At the packet level, it just does not respond. This distinction is important if you have a load balancer in front of nginx. The LB will wait until timeout for a response, occupying a bit of stateful memory and probably causing an error which is indistinguishable from "backend application server is offline".

treffer 4y ago
That is actually cool, it is a tarpit for these bots! On a well configured site the LB timeouts should be short enough anyway. But it is a risk, especially on classic DOS attacks.
- quesera 4y ago
  Yep it's great for tarpitting if you are not behind an LB. The other problem, if you are behind an LB, is that the client (DoS attacker) will get a 503 from the LB after timeout. So, no gain even if your timeouts are reasonable. It'd be great if you could return a custom response from nginx that would tell the LB to drop the request -- or you could move the exploit-detection logic to the LB instead of nginx, and the LB could do its own 444 equivalent.