1

If we send a request from any host like example.com our server gives back a HTTP 1.1 200 OK response status.

In correct condition it should show either 302, 400 or 404 error message (not found response) status. At current condition it is showing 200 OK response message, when its send through our host like xx.xxx.xx.xx.

For example, if we sent this request:

GET /web/ HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:51.0) Gecko/20100101 Firefox/51.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Connection: close
Upgrade-Insecure-Requests: 1

We get this response:

HTTP/1.1 200 OK
Date: Thu, 02 Mar 2017 15:23:20 GMT
Server: figi_Server
X-Frame-Options: deny
Strict-Transport-Security: 1
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Frame-Options: sameorigin
X-XSS-Protection: 1; mode=block

Note:

  1. OS: Ubuntu 14.04.
  2. Web server: Apache 2.2.
  3. Virtual machine running both.

Screenshot of request and response.

  • Using 1. OS : Ubuntu 14.04 2. Web Server : Apache 2.2 3. Virtual Machine Running both things @tim – cruxster Mar 3 '17 at 8:05
4

First, this is not an attack against your server because no harm is done on the server. And, it is not specific to Ubuntu Server version whatever but is specific to the web server and its configuration, i.e. in your case nginx with unknown configuration.

By default the web server has no idea which names are valid for your system. You have to explicitly configure which names are valid and what the server should do if no host header was given or none of the configured host headers was given. With nginx as used on your system this means to configure virtual hosts for all the names you want to accept, configure a default server to reject all requests to unknown names and maybe configure a similar server in case you want to specifically deal with empty host names.
For more details see the nginx documentation, specifically the part about "How to prevent processing requests with undefined server names".

  • Using 1. OS : Ubuntu 14.04 2. Web Server : Apache 2.2 3. Virtual Machine Running both things @Steffen Ullrich – cruxster Mar 3 '17 at 8:06
  • @cruxster: With apache this is similar to with nginx. Just configure VirtualHost for each hostname you want to accept and configure a default host to reject all requests. – Steffen Ullrich Mar 3 '17 at 9:54
  • i have tried this method but not worked .please give me some other solution – cruxster Mar 3 '17 at 11:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.