You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tapestry.apache.org by trsvax <tr...@gmail.com> on 2012/02/21 21:26:48 UTC
Vulnerability Scanners
I've got people running vulnerability scanners against a production site.
I've also got log4j configured to send email exceptions to me and
unfortunately this means I get a lot of email. For example the scanner
requests /index.php~
which results in the following log:
2012-02-21 14:17:37,324 [ajp-bio-8009-exec-48] [ERROR]
TapestryModule.RequestExceptionHandler Processing of request failed with
uncaught exception: Input string 'index.php~' is not valid; the character
'~' at position 10 is not valid.
Which results in a email to me.
I realize I could stop this with some log4j config but what I'd rather do is
just stop all this traffic before it even gets that far. Perhaps if you get
more than 10 exceptions in a minute blacklist your IP. Has anyone done
anything like that or have other suggestions?
Thanks
Barry
--
View this message in context: http://tapestry.1045711.n5.nabble.com/Vulnerability-Scanners-tp5503278p5503278.html
Sent from the Tapestry - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: Vulnerability Scanners
Posted by Steve Eynon <st...@alienfactory.co.uk>.
(I remember the T5.1 patch wasn't pretty, by the way - the URL parser
just threw a new RuntimeException so we decorated the service and had
to parse the exception message looking for "the character 'X' at
position X is not valid.")
--
Steve
-------------------------------
"If at first you don't succeed,
so much for skydiving!"
On 23 February 2012 10:22, Steve Eynon <st...@alienfactory.co.uk> wrote:
> Hiya,
>
> On these errors I usually patch T5 to return a 404 instead - that was
> with some old T5.1 apps, I'm pretty sure we've done the same with T5.3
> but I'm not near the code at the moment...
>
> Steve
> -------------------------------
> "If at first you don't succeed,
> so much for skydiving!"
>
>
>
>
> On 22 February 2012 05:27, trsvax <tr...@gmail.com> wrote:
>> Thanks for the link. Something like that is pretty much what I want and I do
>> run an Apache front end but I don't control that machine. Unfortunately I
>> think my only real option is either a Tomcat filter or some Tapestry code.
>>
>> --
>> View this message in context: http://tapestry.1045711.n5.nabble.com/Vulnerability-Scanners-tp5503278p5503424.html
>> Sent from the Tapestry - User mailing list archive at Nabble.com.
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
>> For additional commands, e-mail: users-help@tapestry.apache.org
>>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: Vulnerability Scanners
Posted by Steve Eynon <st...@alienfactory.co.uk>.
Hiya,
On these errors I usually patch T5 to return a 404 instead - that was
with some old T5.1 apps, I'm pretty sure we've done the same with T5.3
but I'm not near the code at the moment...
Steve
-------------------------------
"If at first you don't succeed,
so much for skydiving!"
On 22 February 2012 05:27, trsvax <tr...@gmail.com> wrote:
> Thanks for the link. Something like that is pretty much what I want and I do
> run an Apache front end but I don't control that machine. Unfortunately I
> think my only real option is either a Tomcat filter or some Tapestry code.
>
> --
> View this message in context: http://tapestry.1045711.n5.nabble.com/Vulnerability-Scanners-tp5503278p5503424.html
> Sent from the Tapestry - User mailing list archive at Nabble.com.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
> For additional commands, e-mail: users-help@tapestry.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: Vulnerability Scanners
Posted by trsvax <tr...@gmail.com>.
Thanks for the link. Something like that is pretty much what I want and I do
run an Apache front end but I don't control that machine. Unfortunately I
think my only real option is either a Tomcat filter or some Tapestry code.
--
View this message in context: http://tapestry.1045711.n5.nabble.com/Vulnerability-Scanners-tp5503278p5503424.html
Sent from the Tapestry - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: Vulnerability Scanners
Posted by Jérôme BERNARD <je...@gmail.com>.
Hi Barry,
I had the same issue a few months ago with various apps (Tapestry and non
Tapestry ones).
If you've got an Apache front-end, have a look at fail2ban (
http://www.fail2ban.org).
It basically scans your error_log and based on typical attacks forbids the
attacker IP to request your apps, by altering the firewall configuration.
IHTH,
Jérôme.
On Tue, Feb 21, 2012 at 21:26, trsvax <tr...@gmail.com> wrote:
> I've got people running vulnerability scanners against a production site.
> I've also got log4j configured to send email exceptions to me and
> unfortunately this means I get a lot of email. For example the scanner
> requests /index.php~
>
> which results in the following log:
>
>
> 2012-02-21 14:17:37,324 [ajp-bio-8009-exec-48] [ERROR]
> TapestryModule.RequestExceptionHandler Processing of request failed with
> uncaught exception: Input string 'index.php~' is not valid; the character
> '~' at position 10 is not valid.
>
> Which results in a email to me.
>
> I realize I could stop this with some log4j config but what I'd rather do
> is
> just stop all this traffic before it even gets that far. Perhaps if you get
> more than 10 exceptions in a minute blacklist your IP. Has anyone done
> anything like that or have other suggestions?
>
> Thanks
> Barry
>
>
> --
> View this message in context:
> http://tapestry.1045711.n5.nabble.com/Vulnerability-Scanners-tp5503278p5503278.html
> Sent from the Tapestry - User mailing list archive at Nabble.com.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
> For additional commands, e-mail: users-help@tapestry.apache.org
>
>
--
Jerome Bernard,
Blog: http://jerome-bernard.com
Re: Vulnerability Scanners
Posted by trsvax <tr...@gmail.com>.
Thanks for the suggestions, here is what I ended up doing.
I created a BlacklistTracker service. If you do things I don't like you are
tracked. For example if you end up on my exception page I track you. Get too
many exceptions and you are blacklisted, too many failed login attempts
blacklisted etc.
To blacklist requests I created a BlacklistLinkTransformer which just does
this:
public PageRenderRequestParameters decodePageRenderRequest(Request request)
{
if ( blacklistTracker.isBlacklist(request) ) {
return new PageRenderRequestParameters("BlackList",new
EmptyEventContext(),false);
}
return null;
}
This way I end up with a few exceptions in my logs then the IP is
blacklisted and I get an email about that also.
--
View this message in context: http://tapestry.1045711.n5.nabble.com/Vulnerability-Scanners-tp5503278p5508501.html
Sent from the Tapestry - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: Vulnerability Scanners
Posted by antalk <an...@intercommit.nl>.
Maybe a contribution to the IgnoredPathsFilter ?
--
View this message in context: http://tapestry.1045711.n5.nabble.com/Vulnerability-Scanners-tp5503278p5507583.html
Sent from the Tapestry - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org