J’ai pu observer deux attaques différentes :
167.71.13.196 - - [15/Oct/2021:01:11:24 +0200] "GET /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/hosts HTTP/1.1" 400 5636 "-" "Lkx-Apache2449TraversalPlugin/0.0.1 (+https://leakix.net/, +https://twitter.com/HaboubiAnis)" 45.93.201.33 - - [15/Oct/2021:08:16:57 +0200] "GET /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd HTTP/1.1" 400 485 "-" "-"
J’ai donc bloqué les ip :
# iptables -A INPUT -s 167.71.13.196 -j DROP # iptables -A INPUT -s 45.93.201.33 -j DROP # /usr/sbin/iptables-save > /etc/iptables/rules.v4
Pour information les IP en question :
| IP Address | Country | Region | City |
|---|---|---|---|
| 167.71.13.196 | Netherlands  |
Noord-Holland | Amsterdam |
| ISP | Organization | Latitude | Longitude |
| DigitalOcean LLC | Not Available | 52.3740 | 4.8897 |
| IP Address | Country | Region | City |
|---|---|---|---|
| 45.93.201.33 | Russian Federation  |
Moskva | Moscow |
| ISP | Organization | Latitude | Longitude |
| LIR LLC | Not Available | 55.7522 | 37.6156 |
A suivre.