Question
Question
Can a firewall block an IP by the text content of the request?
When you look in any web servers access logs, you will find hackers searching for things like cgi, wp-admin and scripts. It is a waste of connections and server resources.
Can a firewall block an IP based on the content of the GET or POST request?
Example log:
178.156.202.250 - - [19/Jul/2019:05:27:51 +0000] “POST /FCKeditor/editor/filemanager/connectors/asp/connector.asp?Command=FileUpload&Type=File&CurrentFolder=%2F HTTP/1.1” 301 351 “http://www.medicalcheckin.com/FCKeditor/editor/filemanager/connectors/asp/connector.asp?Command=FileUpload&Type=File&CurrentFolder=%2F” “Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2)”
178.156.202.250 - - [19/Jul/2019:05:27:52 +0000] “POST /FCKeditor/editor/filemanager/connectors/asp/connector.asp?Command=FileUpload&Type=File&CurrentFolder=%2F HTTP/1.1” 301 351 “http://www.medicalcheckin.com/FCKeditor/editor/filemanager/connectors/asp/connector.asp?Command=FileUpload&Type=File&CurrentFolder=%2F” “Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2)”
178.156.202.250 - - [19/Jul/2019:05:27:53 +0000] “GET /index.php?m=member&c=index&a=register&siteid=1 HTTP/1.1” 301 297 “http://www.medicalcheckin.com/index.php?m=member&c=index&a=register&siteid=1” “Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2)”
This is obviously a hacker. It would be nice to block the IP based on the /FCKeditor/ part of the request. If the request contains /FCKeditor/ drop the connection and ban the IP.
These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.
×