4 ms·
It feels to me more like it's the power of the comprehensive background scanning (I've seen it called 'internet background radiation') that is constantly taking
by mandevil 3y ago
It feels to me more like it's the power of the comprehensive background scanning (I've seen it called 'internet background radiation') that is constantly taking place: anything you forget about, anything you misconfigure, anything you are slow to patch, that is going to be found and exploited by some tool someone built somewhere that is continually searching the entire internet for the same five mistakes.
- pixl97 3y agoAnd it's so easy to do... GET /file.name ERROR 404 [User: wtf is going on] Turns on directory index Sees /filé.name [Oh that's the problem] Forgets to turn directory index off
- gerdesj 3y agoQuite. My firm have a Nessus scanner and we point it at ourselves as well as our customers. There are also several checks on the monitoring system that will flag if something suddenly starts working. Background radiation is about right. Run up a honeypot VM with a web service on it and watch the logs with something like lnav. You soon get a feel for how fast the legitimate (and I use that term advisedly) crawlers like Google and that rock up along with the others. You will see a lot of hits from things with a Github link within their agent header - script kiddies or perhaps clever kiddies pretending to be script kiddies - more analysis needed. You will also see hits from agents claiming to be Google or Bing or Firefox on Commodore 64. Again, careful packet analysis, IP lists etc can be instructive ... if you can be arsed. Anyway. Humans cannot see network traffic. When you instruct your firewall to do something via its GUI or CLI you are merely providing instructions that may or may not actually do anything. Do feel free to actually test it. nmap, for example, is available for port testing and much, much more.