How do I block these \x03\x00 requests? #157
Comments
|
11 Jan 2012 - https://twitter.com/mubix/status/157115321155723264 |
|
And, error in fail2ban: jail.local |
|
Those attack strings are very difficult to block, I started trying to work on a Regex for detecting that some time ago but it's so complex and those strings change so much I found it almost impossible. that's not to say it is impossible but it requires some very crafty regex patterns which I just don't have time to work out. |
|
@mitchellkrogza Fail2ban should have blocked these requests? But it did not work. |
|
If change New error: |
|
@extensionsapp I don't know of any Fail2Ban jail currently that will catch any of these. I've posted a question on Stack to see if some regex genius can figure out a regex pattern for these. |
|
@mitchellkrogza I fix problem in fail2ban, add |
|
Thanks @extensionsapp I'll try that out. Will let you know if I get any answer on Stack for actually detecting these complex strings like this. |
These are the cyrillic names of the actors. |
|
@extensionsapp well done, I would never have figured that out 🥇 |
|
@mitchellkrogza I block these requests: jail.local filter.d/nginx-x00.conf \x03 - not normal in URL Therefore, you can safely block all requests. |
|
Nice one @extensionsapp I will try it out. Someone on Stack Exchange posted this Regex for me, do you want to try it out too?? |
|
Another option with Nginx is .... in all my logs these requests don't use GET,HEAD or POST. |
|
Yes, this is also a good option. It would be nice to check that it's better to block through a fail2ban/iptables or block through nginx. Nginx sends a 405 error to the bot when it is blocked. This page has about 30Kb. If the bot will DDoS 3333 requests per second - 3333 * 30 KB = 100 MB channel will be fully loaded. |
|
@extensionsapp very true but changing that to would just drop the connection immediately |
|
I do agree that catching these with Fail2Ban and blocking them at IPTables level is first prize. Then things like my Fail2Ban Perma-Ban filter can also ban them for extended periods. |
|
The nginx-x00.conf seems to work for me. Thanks @extensionsapp ! As a note: improving the title to add something like "\x03\x00" for "these requests" might make this issue slightly better visible... I think? |
mitchellkrogza
changed the title
|
Thanks for the feedback @RayOei I have updated the title. Can you share your final solution? |
|
Nothing new to add: I used what @extensionsapp proposed ;-) |
Hi @mitchellkrogza.I am newbie in nginx. Can you please tell me in which file I have to set these about parameters? Regards |
One question: If we will block both http,https then which request will work on our server. Thanks in advance. |
|
Both will be blocked |
|
Thanks for you response but if we will restrict both http and https request then if we have some API in our website , will be able to access those APIs? |
|
These requests are generally queries for other protocols such as RDP, so you could also focus on specifically allowing HTTP. A fail2ban-level approach to reducing noise from non-HTTP request lines that I have used myself is the following, failing everything by default, and then ignoring valid structure HTTP queries: |
|
Oh, the solution from @ansell works like this. Although the access.log file still contains the following entry when the offending IP visits you for the first time... 20.243.nn.nn - - [23/Jul/2022:06:53:45 +0100] "" 400 0 "-" "-" ...my fail2ban setting would ban that IP from further probes, thus leading to a cleaner and more actionable log. This will not work for everyone (those who use empty probes); but it works for me. Thanks @ansell |
|
@thakur-isha or anyone informed, please, any feedback on why [nginx-x00] is not working in my setting? nginx saves log in non default location but with standard log structure (not custom) the log shows Fail2ban and nginx config: Thank you in advance for your valuable feedback. |
|
The logpath in jail and location of access_log in nginx are different in your configuration and hence fail2ban does not pick up. |
solved it! |
and others
Hello.
How to block these bots?
Server load reached 78%
"Java/1.6.0_24"- This is not a browser, so you need to block it.The text was updated successfully, but these errors were encountered: