2

I have a web application which has recently been deployed to AWS.

In the last days, i got random requests to admin urls, like /admin.php, wp-admin.php etc. (obvious they are trying to find exploitable sections)

I want to create a blacklist of IPs accessing those urls.

Is there a list of exploitable URLs, so i capture all the IP addresses trying to access them?

I have searched on google a lot, and i could't find anything too useful.

  • 4
    Use caution blacklisting IPs, remember many ISPs assign short term leases for public IPs, the owner of that IP is the attacker one day and a genuine visitor another, You may also end up banning thousands of users for large organisations who use NAT (eg a university) – iainpb Nov 7 '17 at 14:46
  • 1
    Are you using Wordpress? If so, you should use Wordfence which does all this for you. – Bubble Hacker Nov 7 '17 at 14:48
  • 1
    You could try logging IP/URL's for 404's. Then after N days skim through those manually for anything that is clearly not just user error. Maybe add a limited time block - seconds to say maybe 24 hours - to anyone that requests those URLs in future. This means after the first failed attempt their scan will likely fail. – Hector Nov 7 '17 at 15:08
  • 3
    You might also want to look at something like FailToBan or placing your site behind a service like cloudflare. – Hector Nov 7 '17 at 15:09
  • 2
    Your question is more nebulous than you expect. You are not looking for exploitable URL paths, you are looking for common admin page URLs. If you want to know the exploitable URLs, that's a massive undertaking. Frankly, I'd mine your logs for invalid requests and build your list from that. – schroeder Nov 7 '17 at 15:58
1

Have you tried Fail2Ban? One of it's preconfigured filters for Apache is designed to "match web requests for selected URLs that don't exist", and will let you ban offending addresses accordingly.

If memory serves you can customize the bans to expire after a specific amount of time, and kick in after a specific number of violations, so you could set it to block any ip that tries to access /admin.php for 3 days, drastically reducing the viability of random scans while not permanently blocking an IP that might soon belong to a legitimate visitor.

How-to's here or here to help you get started.

The filter I believe you're looking for is called apache-botsearch.conf on my system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.