0

I'm using a tool on my website that detects any error and sends me an email when a code error happens. Recently, I've received some requests not allowed on my IP - not url - where only GET is allowed.

The requests all come from the IP 173.187.177.22 and, besides happening once a minute or two, have a strange input. Here's a few examples of the input passed on three different requests:

array(1) {
  ["QqIKyIubMeV_mOiW6N7CL6c1rCSY9W1cSlveqfTb9P9cpfwTTOL1sOUdhvIphPNeVGdeKl9lhHf7ADk9gLNgePAZdO/ygtxofmT/sfbFyrBKzGvrWRVL6kT2zbkVrV1dOXIQkhDuUUpacUnKuaPkB78z85jmqjY1l7hXnLIONUtctt679mbW9KPHoq1ozFK6Ki1hfN9WnwnaN14akSGWZkDfoVDFdrneVf4JDOlfY3r78Gp39bueUaHn6aMEAGys3MEEjr4ghbHe0T6MURgQyHZHoV1olgRiAo5xRjChrhjD7w/pYaaNi0_6DKHMJBS7H9_bw8I/qaOoFy/EeO4G3QFiIlpcutIEf62YOwlk53MzuuLM5eje9I_TUXc9XmC/kU9EX2QDYYT9wGmg3w/7YJSOIIgi"]=>
  NULL
}
array(1) {
  ["RfZWlNmbZ3O21/tLFs9AFHaO5zr9g/FArn8djhJGYhqs32THrVCnqDI/xUAJcg0DGKi6a/FEz7PzB7GWu72B7uA3ZvdKfNUhSCZR39If6oOCATHN9VYgzYJQfDaPrcqJh3IBaHPcJSgUXsv_amGKAd6AJ675AtCvMfdYUQk5V/Pc1X2LR2M7uDfEW1Mv2S9mHSZSLYV_cDAJFOavCtxfyLQms3kOudm_arsbkn2kQbh1LvaC0iP0aDSfmmEmtFIX_rmMwSGFghPV1mZtELD6NEjuorMwix70CvGi/g27CRmU0qtuVwwlhf67Qi7cZBNCOzAb_mFMfUnp1E4kWhbvIpNyo_c0TuwM_BNRKm9UQc8rdWPk8CmN"]=>
  NULL
}
array(1) {
  ["RfFelN_ZbKsBnezpI20p0My0Rd7Gzx4bNeu9iTNNiizOsqFE_uCyvsWkg_zvep1KlWlp9fTNSImM9hitT/Zrs/UvxMgTp1llGwg1a3WinrqPXZSySmQkaU7WXXHHf/_sWk1OcEp6PfFXczId60vlvr9X7OTVlNDLW7oET38xmCV0Q7sL_s/iLlilTAHIh7ICTxqOTzO2ONFFpcqy/wD6Hw4TEFiS1g6APil_/aJkbd/My6ESB4jXehj3HhEbLUWVRsQlJa6cCVKJpwieEAiZCi/N2EgaEd3jxRdKrIA75VgVPteDdqaSnPUljHXerCMic2UzVfLqWvK4w8beTnoKnQacmJf8c6ANr8l3fU2pQn7zmqdzO/LL6MNsbVF0B0G9iFm0x9fO0cuN8MUW5IlI289ILTvpLpJL2Qg6QQ"]=>
  string(1) "="
}

Any suggestions on what I should put in place to prevent this kind of behavior? In the past I've blocked the IPs responsible for this from .htaccess, but ideally I don't want to continue blocking IPs manually since if it is some sort of attack it could bypass IP

  • 2
    how is this input strange? We have no idea how your code works so we do not understand in what way this input might be concerning (if at all) – schroeder Oct 11 '17 at 9:36
  • the code is not meant to do POST requests on home page and, having 1'200 visitors everyday seems strange that only that IP gives error... it's just very suspicious – clod986 Oct 11 '17 at 9:42
  • Did your server IP change recently or is the server new? Could this be a client of some other service trying to connect to a server that no longer exists on that IP? – schroeder Oct 11 '17 at 9:44
  • 1
    There are tons of bots scanning the whole internet and trying to exploit known vulnerabilities. Over time, you will be getting more and more of them, as your website becomes more visible in google. – Aria Oct 11 '17 at 9:46
  • 1
    Reading back through the HTTP spec 501 is the correct response. – Hector Oct 11 '17 at 10:59
1

The standard way to address unexpected and invalid inputs from web clients is to install a WAF (web application firewall). There are free and paid versions.

In this firewall, you configure the types of valid inputs and you can drop/reject/correct invalid inputs. Not only can this help with bots/hackers testing your app for weaknesses, but it can address things like SQLi, XSS, etc.

While a WAF can get complex fast (you can define valid inputs for each one of your functions, which is something to consider), you can also provide "broad stroke" protection and define that POSTs are invalid, for instance.

  • I chose to exit() in case a method different from GET is used on home page. I guess it's in line with your answer, just really basic – clod986 Oct 11 '17 at 10:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.