Hacker detection module?

This is a discussion on Hacker detection module? within the Apache Web Server forums, part of the Web Server and Related Forums category; Some entries in my log file show hackers looking for php vulnerabilities: 216.206.179.136 - - [09/May/2006:11:...


Go Back   Usenet Forums > Web Server and Related Forums > Apache Web Server

Reload this Page Hacker detection module?

FAQ Members List Calendar Search Today's Posts Mark Forums Read

 

 

LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 05-09-2006
Ignoramus19605
 
Posts: n/a
Default Hacker detection module?
Some entries in my log file show hackers looking for php
vulnerabilities:

216.206.179.136 - - [09/May/2006:11:17:48 -0500] "GET /ads/adxmlrpc.php HTTP/1.0" 404 294 "-" "-"
216.206.179.136 - - [09/May/2006:11:17:48 -0500] "GET /xmlrpc.php HTTP/1.0" 404 288 "-" "-"
216.206.179.136 - - [09/May/2006:11:17:48 -0500] "GET /xmlrpc/xmlrpc.php HTTP/1.0" 404 295 "-" "-"
216.206.179.136 - - [09/May/2006:11:17:48 -0500] "GET /xmlsrv/xmlrpc.php HTTP/1.0" 404 295 "-" "-"
216.206.179.136 - - [09/May/2006:11:17:48 -0500] "GET /blog/xmlrpc.php HTTP/1.0" 404 293 "-" "-"
216.206.179.136 - - [09/May/2006:11:17:49 -0500] "GET /drupal/xmlrpc.php HTTP/1.0" 404 295 "-" "-"
216.206.179.136 - - [09/May/2006:11:17:49 -0500] "GET /community/xmlrpc.php HTTP/1.0" 404 298 "-" "-"
216.206.179.136 - - [09/May/2006:11:17:49 -0500] "GET /blogs/xmlrpc.php HTTP/1.0" 404 294 "-" "-"
216.206.179.136 - - [09/May/2006:11:17:49 -0500] "GET /blogs/xmlsrv/xmlrpc.php HTTP/1.0" 404 301 "-" "-"
216.206.179.136 - - [09/May/2006:11:17:49 -0500] "GET /blog/xmlsrv/xmlrpc.php HTTP/1.0" 404 300 "-" "-"
216.206.179.136 - - [09/May/2006:11:17:50 -0500] "GET /blogtest/xmlsrv/xmlrpc.php HTTP/1.0" 404 304 "-" "-"
216.206.179.136 - - [09/May/2006:11:17:50 -0500] "GET /b2/xmlsrv/xmlrpc.php HTTP/1.0" 404 298 "-" "-"
216.206.179.136 - - [09/May/2006:11:17:50 -0500] "GET /b2evo/xmlsrv/xmlrpc.php HTTP/1.0" 404 301 "-" "-"
216.206.179.136 - - [09/May/2006:11:17:50 -0500] "GET /wordpress/xmlrpc.php HTTP/1.0" 404 298 "-" "-"
216.206.179.136 - - [09/May/2006:11:17:50 -0500] "GET /phpgroupware/xmlrpc.php HTTP/1.0" 404 301 "-" "-"


Is there some way (a module perhaps) to quickly detect such hack attacks and block the IP?

i
  #2 (permalink)  
Old 05-11-2006
Andrew Kenna
 
Posts: n/a
Default Re: Hacker detection module?
write a script that you run in your crontab that rips out the ip addresses
of requests that match a certain string, email them to you and then you
would need to add them into your firewall..

Andrew

"Ignoramus19605" <ignoramus19605@NOSPAM.19605.invalid> wrote in message
news:du38g.31035$j33.10410@fe84.usenetserver.com.. .
> Some entries in my log file show hackers looking for php
> vulnerabilities:
>
> 216.206.179.136 - - [09/May/2006:11:17:48 -0500] "GET /ads/adxmlrpc.php
HTTP/1.0" 404 294 "-" "-"
> 216.206.179.136 - - [09/May/2006:11:17:48 -0500] "GET /xmlrpc.php
HTTP/1.0" 404 288 "-" "-"
> 216.206.179.136 - - [09/May/2006:11:17:48 -0500] "GET /xmlrpc/xmlrpc.php
HTTP/1.0" 404 295 "-" "-"
> 216.206.179.136 - - [09/May/2006:11:17:48 -0500] "GET /xmlsrv/xmlrpc.php
HTTP/1.0" 404 295 "-" "-"
> 216.206.179.136 - - [09/May/2006:11:17:48 -0500] "GET /blog/xmlrpc.php
HTTP/1.0" 404 293 "-" "-"
> 216.206.179.136 - - [09/May/2006:11:17:49 -0500] "GET /drupal/xmlrpc.php
HTTP/1.0" 404 295 "-" "-"
> 216.206.179.136 - - [09/May/2006:11:17:49 -0500] "GET
/community/xmlrpc.php HTTP/1.0" 404 298 "-" "-"
> 216.206.179.136 - - [09/May/2006:11:17:49 -0500] "GET /blogs/xmlrpc.php
HTTP/1.0" 404 294 "-" "-"
> 216.206.179.136 - - [09/May/2006:11:17:49 -0500] "GET
/blogs/xmlsrv/xmlrpc.php HTTP/1.0" 404 301 "-" "-"
> 216.206.179.136 - - [09/May/2006:11:17:49 -0500] "GET
/blog/xmlsrv/xmlrpc.php HTTP/1.0" 404 300 "-" "-"
> 216.206.179.136 - - [09/May/2006:11:17:50 -0500] "GET
/blogtest/xmlsrv/xmlrpc.php HTTP/1.0" 404 304 "-" "-"
> 216.206.179.136 - - [09/May/2006:11:17:50 -0500] "GET
/b2/xmlsrv/xmlrpc.php HTTP/1.0" 404 298 "-" "-"
> 216.206.179.136 - - [09/May/2006:11:17:50 -0500] "GET
/b2evo/xmlsrv/xmlrpc.php HTTP/1.0" 404 301 "-" "-"
> 216.206.179.136 - - [09/May/2006:11:17:50 -0500] "GET
/wordpress/xmlrpc.php HTTP/1.0" 404 298 "-" "-"
> 216.206.179.136 - - [09/May/2006:11:17:50 -0500] "GET
/phpgroupware/xmlrpc.php HTTP/1.0" 404 301 "-" "-"
>
>
> Is there some way (a module perhaps) to quickly detect such hack attacks
and block the IP?
>
> i
>
  #3 (permalink)  
Old 05-11-2006
Ignoramus18731
 
Posts: n/a
Default Re: Hacker detection module?
On Thu, 11 May 2006 12:49:56 +1000, Andrew Kenna <akenna@westnet.com.au> wrote:
> write a script that you run in your crontab that rips out the ip addresses
> of requests that match a certain string, email them to you and then you
> would need to add them into your firewall..

I want it to work much faster than that, there is no point in blocking
those IPs many minutes after attacks already occurred.

I will just write a tailing perl script, I think, that would tail
/var/log/httpd/access_log and match patterns.

i

> Andrew
>
> "Ignoramus19605" <ignoramus19605@NOSPAM.19605.invalid> wrote in message
> news:du38g.31035$j33.10410@fe84.usenetserver.com.. .
>> Some entries in my log file show hackers looking for php
>> vulnerabilities:
>>
>> 216.206.179.136 - - [09/May/2006:11:17:48 -0500] "GET /ads/adxmlrpc.php
> HTTP/1.0" 404 294 "-" "-"
>> 216.206.179.136 - - [09/May/2006:11:17:48 -0500] "GET /xmlrpc.php
> HTTP/1.0" 404 288 "-" "-"
>> 216.206.179.136 - - [09/May/2006:11:17:48 -0500] "GET /xmlrpc/xmlrpc.php
> HTTP/1.0" 404 295 "-" "-"
>> 216.206.179.136 - - [09/May/2006:11:17:48 -0500] "GET /xmlsrv/xmlrpc.php
> HTTP/1.0" 404 295 "-" "-"
>> 216.206.179.136 - - [09/May/2006:11:17:48 -0500] "GET /blog/xmlrpc.php
> HTTP/1.0" 404 293 "-" "-"
>> 216.206.179.136 - - [09/May/2006:11:17:49 -0500] "GET /drupal/xmlrpc.php
> HTTP/1.0" 404 295 "-" "-"
>> 216.206.179.136 - - [09/May/2006:11:17:49 -0500] "GET
> /community/xmlrpc.php HTTP/1.0" 404 298 "-" "-"
>> 216.206.179.136 - - [09/May/2006:11:17:49 -0500] "GET /blogs/xmlrpc.php
> HTTP/1.0" 404 294 "-" "-"
>> 216.206.179.136 - - [09/May/2006:11:17:49 -0500] "GET
> /blogs/xmlsrv/xmlrpc.php HTTP/1.0" 404 301 "-" "-"
>> 216.206.179.136 - - [09/May/2006:11:17:49 -0500] "GET
> /blog/xmlsrv/xmlrpc.php HTTP/1.0" 404 300 "-" "-"
>> 216.206.179.136 - - [09/May/2006:11:17:50 -0500] "GET
> /blogtest/xmlsrv/xmlrpc.php HTTP/1.0" 404 304 "-" "-"
>> 216.206.179.136 - - [09/May/2006:11:17:50 -0500] "GET
> /b2/xmlsrv/xmlrpc.php HTTP/1.0" 404 298 "-" "-"
>> 216.206.179.136 - - [09/May/2006:11:17:50 -0500] "GET
> /b2evo/xmlsrv/xmlrpc.php HTTP/1.0" 404 301 "-" "-"
>> 216.206.179.136 - - [09/May/2006:11:17:50 -0500] "GET
> /wordpress/xmlrpc.php HTTP/1.0" 404 298 "-" "-"
>> 216.206.179.136 - - [09/May/2006:11:17:50 -0500] "GET
> /phpgroupware/xmlrpc.php HTTP/1.0" 404 301 "-" "-"
>>
>>
>> Is there some way (a module perhaps) to quickly detect such hack attacks
> and block the IP?
>>
>> i
>>
>
>
  #4 (permalink)  
Old 05-11-2006
Josselin
 
Posts: n/a
Default Re: Hacker detection module?
On 2006-05-11 04:49:56 +0200, "Andrew Kenna" <akenna@westnet.com.au> said:

> write a script that you run in your crontab that rips out the ip addresses
> of requests that match a certain string, email them to you and then you
> would need to add them into your firewall..
>
> Andrew
>
> "Ignoramus19605" <ignoramus19605@NOSPAM.19605.invalid> wrote in message
> news:du38g.31035$j33.10410@fe84.usenetserver.com.. .
>> Some entries in my log file show hackers looking for php
>> vulnerabilities:
>>
>> 216.206.179.136 - - [09/May/2006:11:17:48 -0500] "GET /ads/adxmlrpc.php
> HTTP/1.0" 404 294 "-" "-"
>> 216.206.179.136 - - [09/May/2006:11:17:48 -0500] "GET /xmlrpc.php
> HTTP/1.0" 404 288 "-" "-"
>> 216.206.179.136 - - [09/May/2006:11:17:48 -0500] "GET /xmlrpc/xmlrpc.php
> HTTP/1.0" 404 295 "-" "-"
>> 216.206.179.136 - - [09/May/2006:11:17:48 -0500] "GET /xmlsrv/xmlrpc.php
> HTTP/1.0" 404 295 "-" "-"
>> 216.206.179.136 - - [09/May/2006:11:17:48 -0500] "GET /blog/xmlrpc.php
> HTTP/1.0" 404 293 "-" "-"
>> 216.206.179.136 - - [09/May/2006:11:17:49 -0500] "GET /drupal/xmlrpc.php
> HTTP/1.0" 404 295 "-" "-"
>> 216.206.179.136 - - [09/May/2006:11:17:49 -0500] "GET
> /community/xmlrpc.php HTTP/1.0" 404 298 "-" "-"
>> 216.206.179.136 - - [09/May/2006:11:17:49 -0500] "GET /blogs/xmlrpc.php
> HTTP/1.0" 404 294 "-" "-"
>> 216.206.179.136 - - [09/May/2006:11:17:49 -0500] "GET
> /blogs/xmlsrv/xmlrpc.php HTTP/1.0" 404 301 "-" "-"
>> 216.206.179.136 - - [09/May/2006:11:17:49 -0500] "GET
> /blog/xmlsrv/xmlrpc.php HTTP/1.0" 404 300 "-" "-"
>> 216.206.179.136 - - [09/May/2006:11:17:50 -0500] "GET
> /blogtest/xmlsrv/xmlrpc.php HTTP/1.0" 404 304 "-" "-"
>> 216.206.179.136 - - [09/May/2006:11:17:50 -0500] "GET
> /b2/xmlsrv/xmlrpc.php HTTP/1.0" 404 298 "-" "-"
>> 216.206.179.136 - - [09/May/2006:11:17:50 -0500] "GET
> /b2evo/xmlsrv/xmlrpc.php HTTP/1.0" 404 301 "-" "-"
>> 216.206.179.136 - - [09/May/2006:11:17:50 -0500] "GET
> /wordpress/xmlrpc.php HTTP/1.0" 404 298 "-" "-"
>> 216.206.179.136 - - [09/May/2006:11:17:50 -0500] "GET
> /phpgroupware/xmlrpc.php HTTP/1.0" 404 301 "-" "-"
>>
>>
>> Is there some way (a module perhaps) to quickly detect such hack attacks
> and block the IP?
>>
>> i

write an email to : abuse@qwest.net
qwest communications corp
and tell tthem than someone is using their server for hacking....
  #5 (permalink)  
Old 05-15-2006
Seeker
 
Posts: n/a
Default Re: Hacker detection module?
Ignoramus19605 wrote:

> Is there some way (a module perhaps) to quickly detect such hack attacks and block the IP?

Automatically blocking IPs is a dangerous practice. What if they spoof
as 127.0.0.1 or a DNS server you use?
 

« Previous Thread | Next Thread »

Thread Tools
Display Modes
Linear Mode Linear Mode

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
vB code is On
Smilies are Off
[IMG] code is Off
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT +1. The time now is 01:48 PM.

Contact Us - Usenet Forums - Archive - Top

Powered by vBulletin® Version 3.6.8
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO 3.0.0