1

Every day my server receives many GET requests in search of security holes. In other words, they are trying a list of words in search of a hole.

for example:

http://myapp.com/phpmyadmin
http://myapp.com/pma
http://myapp.com/phpini.php
http://myapp.com/phpMyAdmin-2.11.7.1-all-languages-utf-8-only
http://myapp.com/phpMyAdmin-2.8.2
...

(I've also found something like that: w00tw00t.at.blackhats.romanian.anti-sec, they are using also PHPMyAdmin weakness)

Where I can find a list with all of those words they are using for attacks? I'd like to block all of them using a list of common words.

EDIT: My first idea is to block IP when they are trying too many times in a short time. It's a good idea or it's impossible to reach?

  • From the output you describing it seems that tools like dirbuster, dirsearch, dirb etc... are used. So you can start with the wordlists those tools use by default (in Kali linux I think most of those wordlists are in /usr/share/ directory). But don't forget that there are also some custom wordlists e.g. on github etc... – game0ver Nov 11 '19 at 11:24
  • Thanks for the advice (Kali linux). I don't find any wordlists in github or similary... do you have an idea where I can find a list for start? Thanks again. – andreah Nov 11 '19 at 11:28
  • 2
    The list you are looking for is massive and grows daily. Blacklisting those things will be an impossible task. You need a different approach. Like blocking the IPs that make too many improper GET requests. – schroeder Nov 11 '19 at 11:28
  • My idea was ban the ip when trying too many times from a list. Do you think it's impossible? Thanks. – andreah Nov 11 '19 at 11:31
  • 1
    @andreah perhaps search the logs for 404 HTTP responses and use a tool like fail2ban to block when there are too many. – multithr3at3d Nov 11 '19 at 13:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.