By Jay
When you look in any web servers access logs, you will find hackers searching for things like cgi, wp-admin and scripts. It is a waste of connections and server resources.
Can a firewall block an IP based on the content of the GET or POST request?
Example log: 178.156.202.250 - - [19/Jul/2019:05:27:51 +0000] “POST /FCKeditor/editor/filemanager/connectors/asp/connector.asp?Command=FileUpload&Type=File&CurrentFolder=%2F HTTP/1.1” 301 351 “http://www.medicalcheckin.com/FCKeditor/editor/filemanager/connectors/asp/connector.asp?Command=FileUpload&Type=File&CurrentFolder=%2F” “Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2)” 178.156.202.250 - - [19/Jul/2019:05:27:52 +0000] “POST /FCKeditor/editor/filemanager/connectors/asp/connector.asp?Command=FileUpload&Type=File&CurrentFolder=%2F HTTP/1.1” 301 351 “http://www.medicalcheckin.com/FCKeditor/editor/filemanager/connectors/asp/connector.asp?Command=FileUpload&Type=File&CurrentFolder=%2F” “Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2)” 178.156.202.250 - - [19/Jul/2019:05:27:53 +0000] “GET /index.php?m=member&c=index&a=register&siteid=1 HTTP/1.1” 301 297 “http://www.medicalcheckin.com/index.php?m=member&c=index&a=register&siteid=1” “Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2)”
This is obviously a hacker. It would be nice to block the IP based on the /FCKeditor/ part of the request. If the request contains /FCKeditor/ drop the connection and ban the IP.
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
Hello,
Yes, you would need a web application firewall as it would inspect the packets and the requests all the way up to layer 7 and block any known malicious requests like SQL injections, Cross site scripting and etc.
You could for example use ModSecurity along with the OWASP ModSecurity Core Rule Set (CRS):
Here’s a great article on how to install that on CentOS:
https://tecadmin.net/install-modsecurity-with-apache-on-centos-rhel/
Hope that this helps! Bobby
Become a contributor for community
Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.
DigitalOcean Documentation
Full documentation for every DigitalOcean product.
Resources for startups and SMBs
The Wave has everything you need to know about building a business, from raising funding to marketing your product.
The developer cloud
Scale up as you grow — whether you're running one virtual machine or ten thousand.
Get started for free
Sign up and get $200 in credit for your first 60 days with DigitalOcean.*
*This promotional offer applies to new accounts only.