5 ms·
Ah, I had a similar idea. There were too many bots or vulnerability scanners hitting /wp-admin.php on my blog. It was flooding my access logs with 404s because
by HeckFeck 3y ago
Ah, I had a similar idea. There were too many bots or vulnerability scanners hitting /wp-admin.php on my blog. It was flooding my access logs with 404s because I don't rock wordpress. Irksome stuff.
So I threw up a little 'surprise' for the ahem penetration testers ahem, if you feel brave: https://www.thran.uk/wp-login.php https://www.thran.uk/wp-login.php
- pugworthy 3y agoEven in the source as a comment :)
- mock-possum 3y agoWell that’s fun
- rabbits_2002 3y agoSafari offered to save the password lmao
- joshmanders 3y agoThis is absolutely amazing. More people should do this.
- viraptor 3y agoThese attempts are almost entirely automated, so almost nobody will see it. But if you want to help, tarpitting any IP which requests that page will slow down the scanner with minimum resource usage on your side.
- michaelcampbell 3y agoyeah, a quick failtoban rule is (as a server operator) every bit as satisfying.
- dym_sh 3y agodoes it respond with 42.zip upon submitting admin-admin?
- HeckFeck 3y agoI'm working on maximising flow control of the payload.
- tempodox 3y agoThat will make for a lot of sewage.
- auguzanellato 3y ago42.gzip served directly as a response with Content-Encoding: gzip would be funnier :D
- imglorp 3y agoHow about a JS fork bomb, on rotation with 42.zip?
- saberience 3y agoomg! That scared the shit out of me!
- focusedone 3y agoThis is fabulous and I intend to steal your idea.
- undebuggable 3y ago> There were too many bots or vulnerability scanners hitting /wp-admin.php on my blog There are moments I'm about to deploy something similar and by now what's stopping me are laziness and other higher priorities. I'm staring at these aggravating items in server log and maybe someday.
- cwmma 3y agoif you filter out requests that don't have a host defined that clears up pretty much all of those requests
- RedShift1 3y agoRisky click of the day. No regrets.
- mpsprd 3y agoThis made me nostalgic of the old ytmnd days
- gosub100 3y agoif you watch this at work, mute your speakers to avoid any furrowed brows.
- Cthulhu_ 3y agoMy basic security measures for a simple wordpress site is to rename wp-admin to something else, rename the admin account to something else, and change the ssh port to something else. That already confuses 99% of login attempts / lazy bots.
- pgraf 3y agoOmg! One random comment that did not only made my day, but my WEEK :-P
- deleted 3y ago[deleted]
- tremon 3y agoNice. I'd probably have settled for something simple like <form action="http://127.1/wp-login.php http://127.1/wp-login.php">. These days, you could serve a JS bitcoin miner instead.
- StimDeck 3y ago[dead]