ShubhamTatvamasi
commented
5 years ago Can someone tell me how to block all these paths using nginx?
Open glenjarvis opened 6 years ago
ShubhamTatvamasi
commented
5 years ago Can someone tell me how to block all these paths using nginx?
Project description
If one were to create a new basic webserver, listening on :80, it would not take long for hacker attempts to be made against that site. For example, one may see an HTTP GET Request for
/.bitcoin/wallet.dator/admin/config.phpor/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax. These are clear attempts to access the website in a non-authorized way. This is especially true if the site is not BitCoin mining related, a PHP website or a Drupal site.Although there is little harm for these types of Kiddie Scripting attempts, they often can be annoying for a website using Django technology.
In Django on an AWS node behind a load balancer, the
HTTP_X_FORWARDED_FORheader contain a list of IP addresses. The first is the source IP, for example: 2.203.36.157.Thus, we can know that this IP address (randomly chosen) 2.203.36.157 has made an access request to one of the URLs in the table below. By Reverse IP Lookup, we can determine the source of the original sender. In this particular case it is: Vodophone DSL in Solingen, North Rhine-Westphalia, Germany, Europe.
Often there are multiple simultaneous requests from users that hit a URL from the table below. If there are many attempts (for example, if all three of these URLs were accessed)
/.bitcoin/wallet.datand/admin/config.phpand/user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajaxwe can safely assume this is a non-authorized attempt (especially if the site is a Django site).This project is a Django Middleware that:
There are additional manage.py commands that can be run on a regular basis to:
abuse@..email addresses for the report would be very handy (and may be its own project)Often we don't complain because the information is too hard to collate in order to make the report. And, there are some companies, such as Amazon and Google who would respond to such complaints.
One should always be able to choose to manually review any reports before they are submitted. There may be some reports that we do not wish to send.
Table 1.1: Sample unauthorized URL patterns that I have seen against a Django site:
Relevant Technology
Django Middleware on any platform
Complexity and required time
Complexity
One could argue that an Advanced level of complexity is helpful to prevent Webpage slow downs as there are components in the Django Middleware that may be seen by every web request.
Required time (ETA)