Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have ASP.NET servers hosted in IIS, regularly i see bots attempting to scan my server searching for outdated versions of phpMyAdmin, mysql etc.

Currently these requests all return 404 because that's the legitimate response as /phpMyAdmin-2.5.1/index.php certainly doesn't exist.

Is there something better that should be done?

My best thoughts, is there anyway to tell IIS to completely abandon a client connection without informing the client so basically it looks like the server just doesn't exist or is completely offline for those addresses?

share|improve this question
    
Some other thoughts, is it possible for an ASP.NET site that detects an attack could then tell iis.net/download/dynamiciprestrictions to add the ip of that user? –  Chris Marisic Aug 23 '12 at 21:43
    
Have a look on this: west-wind.com/weblog/posts/2007/Apr/28/… –  Andrew Smith Aug 23 '12 at 21:48

2 Answers 2

The problem is that you may have vulnerabilities in your system. Scans are unavoidable.

Scan your own site and make sure you are immune to such low hanging fruit. Pay an application penetration tester to make sure you are immune from more threatening attacks. Use a web application firewall like mod_security to filter attacks before they hit your web application.

share|improve this answer
    
-1 this is completely unrelated to my question –  Chris Marisic Aug 24 '12 at 12:28
    
@Chris Marisic The community doesn't seem to think so... In any case I updated my answer. –  Rook Aug 24 '12 at 16:44

Very good solution is Hacker Basher. This is something you can do yourself. Simply on IIS install virtualhost as the IP address - because bots are requesting http://192.168.1.1/ and not http://www.example.com/, so such hacker basher solution can do the following:

  • block ip number from making further access by adding it to blacklist
  • always response with the same 403 code

Ideally, you can install ModSecurity, and its rules are made the way, that it checks no. of headers and if there is no valid Host:, it usually triggers 403 response too.

ModSecurity is highly recommeded solution but some self-made hacker basher would do also a lot. For example, HP runs a monthly scan on their cloud servers, with hacker basher I dodged all of this stuff, as they dont use FQDN.

This is very helpful because it prevents bots from collecting data and fingerprints from your servers, and effectively prevents many bots from breaking thru web server, if you forgot to patch it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.