9

I've noticed a curious flood pattern on some of my sites - bots trying to access the page ​"/-​/-​/-​/-​/-​/-​/-​/-​/-​/-​/" on the root domain - that's 11 slashes alternated by 10 dashes.

The thing with this is that it may be quite difficult for firewalls to catch it - Cloudflare and Wordfence are doing poorly (only working in certain conditions). Well, due to the nature of the string I couldn't even find anything on google.

For now I'm doing a redirect to a sort of honey-trap, but I'm nonetheless curious what it's trying to achieve and how it can better be rid of.

1

This is called a Full Path Disclosure attack. This kind of attack allows the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. It keeps on adding slashes like ///// until it gets a file or anything interesting, and won't stop. It floods the site with slashes and special characters and the attacker may not know it but he is DDoSing the site. To stop this kind of attack you can use fail2ban or use nginx and set heavy caching of /.

  • Could you specify what you mean by "it"? When you say "it searches", "it floods the site" and "until it gets a file"? – Tom K. Aug 22 '18 at 12:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.