Tag Info

New answers tagged

0

This is the slow loris attack of incomplete HTTP GET Requests. How to protect your server: Update your Apache Server, there are many updates for this attack, this attack was discovered in like 2011. Other options are to reduce timeout on your Apache Server, etc. This attack works on timeout. Here tells you how to protect your Apache from DoS/DDoS (slow ...


3

This is the slow loris attack of incomplete HTTP GET Requests. How to protect your server: Update your Apache Server, there are many updates for this attack, this attack was discovered in like 2011. Other options are to reduce timeout on your Apache Server, etc. This attack works on timeout. Here tells you how to protect your Apache from DoS/DDoS (slow ...


1

Here 6 key steps : 1 - Secure your application code 2 - disable all modules not used. Try to disable all, and then, one by one, add modules. 3 - remove all scripts and backup files in the web folder. 4 - disable directory listing 5 - use modsecurity to protect your application from application-level attacks. 6 - Use Fail2ban to trigger HTTP errors ...


3

I decoded the whole code by changing the eval function to var_dump. This gave me: string(133) "$_X=base64_decode($_X);$_X=strtr($_X,'123456aouie','aouie123456');$_R=ereg_replace('__FILE__',"'".$_F."'",$_X);eval($_R);$_R=0;$_X=0;" or formatted: $_X=base64_decode($_X); $_X=strtr($_X,'123456aouie','aouie123456'); $_R=ereg_replace('__FILE__',"'".$_F."'",$_X); ...


15

You can decode the start of $_X: root@bt:~# echo -e ...


4

Once you format the code a little, like how I edited your question, it's easier to see what's going on. $OOO000000=urldecode('%66%67%36%73%62%65%68%70%72%61%34%63%6f%5f%74%6e%64' translates to $OOO000000=fg6sbehpra4co_tnd All of that is used to build the string: $OOO0000O0=base64_decode The eval section is base64 encoded and resolves to: ...


6

You are being hit with Shellshock attempts. As long as you have patched your bash, you should be safe against these attempts. However, you might want to invest in a system for banning repeat system abusers. Try fail2ban. What is a specific example of how the Shellshock Bash bug could be exploited? If you haven't patched bash, you are in big, big trouble. ...


0

Each connection should be send completely (so send a complete incomplete request), the incomplete GET request will make the server think that you are on a poor connection and keeps waiting for the rest of the request. Each connection does require its own port, for this reason slowloris doesn't work well on windows, which limits it to ~130 ports. Sending the ...



Top 50 recent answers are included