Can a firewall block an IP by the text content of the request?

July 19, 2019 297 views
Firewall CentOS

When you look in any web servers access logs, you will find hackers searching for things like cgi, wp-admin and scripts. It is a waste of connections and server resources.

Can a firewall block an IP based on the content of the GET or POST request?

Example log:
178.156.202.250 - - [19/Jul/2019:05:27:51 +0000] “POST /FCKeditor/editor/filemanager/connectors/asp/connector.asp?Command=FileUpload&Type=File&CurrentFolder=%2F HTTP/1.1” 301 351 “http://www.medicalcheckin.com/FCKeditor/editor/filemanager/connectors/asp/connector.asp?Command=FileUpload&Type=File&CurrentFolder=%2F” “Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2)”
178.156.202.250 - - [19/Jul/2019:05:27:52 +0000] “POST /FCKeditor/editor/filemanager/connectors/asp/connector.asp?Command=FileUpload&Type=File&CurrentFolder=%2F HTTP/1.1” 301 351 “http://www.medicalcheckin.com/FCKeditor/editor/filemanager/connectors/asp/connector.asp?Command=FileUpload&Type=File&CurrentFolder=%2F” “Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2)”
178.156.202.250 - - [19/Jul/2019:05:27:53 +0000] “GET /index.php?m=member&c=index&a=register&siteid=1 HTTP/1.1” 301 297 “http://www.medicalcheckin.com/index.php?m=member&c=index&a=register&siteid=1” “Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2)”

This is obviously a hacker. It would be nice to block the IP based on the /FCKeditor/ part of the request. If the request contains /FCKeditor/ drop the connection and ban the IP.

1 Answer

Hello,

Yes, you would need a web application firewall as it would inspect the packets and the requests all the way up to layer 7 and block any known malicious requests like SQL injections, Cross site scripting and etc.

You could for example use ModSecurity along with the OWASP ModSecurity Core Rule Set (CRS):

Here’s a great article on how to install that on CentOS:

https://tecadmin.net/install-modsecurity-with-apache-on-centos-rhel/

Hope that this helps!
Bobby

Have another answer? Share your knowledge.