1

I'm currently working on some modules on hackthebox. In that regard, I recently set up a web service: sudo python3 -m http.server 8080

When I did a wget to my server, it showed up in the log as usual, however I also got some random IP's doing some shenanigans to my server.

61.x - - [03/Aug/2023 13:30:07] code 501, message Unsupported method ('POST')
61.x - - [03/Aug/2023 13:30:07] "POST /cgi-bin/ViewLog.asp HTTP/1.1" 501 -
45.x - - [03/Aug/2023 13:50:40] code 501, message Unsupported method ('CONNECT')
45.x - - [03/Aug/2023 13:50:40] "CONNECT www.twitch.tv:443 HTTP/1.1" 501 -
87.x - - [03/Aug/2023 13:56:51] "GET / HTTP/1.1" 200

Most likely just some automated scans, but what can I do to prevent this from happening in the future?

What is the security community's way of handling such an attempt/attack?

3

2 Answers 2

1

As an alternative to a firewall, you can (and should) bind the server to only listen on the loopback interface. The http.server script takes -h as a parameter to print out help information, which will tell you that it takes port as an optional parameter (defaulting to 8000) and --bind <ADDRESS> as an optional parameter (defaulting to all interfaces).

For a server that will only be accessed on your local computer, you should instead bind to the loopback device, which is technically any address in the 127.0.0.0 /8 network range, but by convention the address 127.0.0.1 is used (for IPv4, which is what http.server expects). This address is commonly named "localhost".

As such (and taking into account the very good advice to not run the server as root), you should start your server using python3 -m http.server --bind 127.0.0.1 8080 or python3 -m http.server --bind localhost 8080. This will prevent any external machines - even on your local LAN, much less the Internet - from connecting to the server at all, and doesn't require configuring or even having a firewall.


With that said, note that there still may be ways to attack the server. For example, web pages could attack it from your own browser; if you visit a page that contains <img src="http://localhost:8080/do_thing"> in the HTML, your browser will send a GET request to the server's /do_thing path from the local machine, so the server will get the request (though for that specific path it would probably return a 404). Furthermore, the page could even contain HTML forms, or javascript, that send more complicated requests (such as POST requests to arbitrary paths with an attacker-chosen request body), and that can port-scan your machine, trying every possible port in a short time.

This is a way to use CSRF attacks to attack a server even if it is behind a firewall or only bound to loopback. Preventing that would require running the server in an isolated network namespace that your browser can't talk to (except, presumably, for a browser that you launch also in that namespace, but which can't talk to the Internet). Of course, such an attack is extremely unlikely in practice, and you can also avoid it by just not having any browser tabs open to Internet pages while the server is running (or at least, having tabs only open to pages you trust to not attempt such things).

0

In addition to the answers @mti2935 has pointed:

You run your application as a root. Don't do it. A security bug in your application can allow an attacker to get full control of your server.

Instead, create a user with as little privileges as possible and run using this account. This will limit possible problems.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .