better solution is to use known exploit methods to craft logging iptables rules so you can track who and where attempts occur. The last line of the tables for those is to send to the bit bucket.<br><br>However, most exploits of web servers are application layer and not network layer. So again, logs are post-mortem only unless you have the apache logs tee'd to a fast, active processor that filters and provides iptables blocking rules.<br>
<br><div class="gmail_quote">On Wed, Oct 10, 2012 at 12:09 PM, Jim Kinney <span dir="ltr"><<a href="mailto:jim.kinney@gmail.com" target="_blank">jim.kinney@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
keep in mind that any program that looks in logs for known exploit patterns has already failed. By the time the exploit appears in the logs, you're compromised.<br><br>Best bet is to harden against the attacks by keeping public facing systems totally patched and lock down all unused "stuff". Don't have a compiler on a web server! <br>
<div class="HOEnZb"><div class="h5">
<br><div class="gmail_quote">On Wed, Oct 10, 2012 at 9:28 AM, Chuck Payne <span dir="ltr"><<a href="mailto:terrorpup@gmail.com" target="_blank">terrorpup@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>Guys, <br></div><div><br></div><div>Thanks, but I have re-invented the wheel. I didn't like anything out there. I will keep doing my research. I had only asked because I was hoping to see what others have seen in their logs and improve my program. I will skimming Google. </div>
<div><br></div><div>My program looks at current logs for patterns and creates iptables rules on them. This is working well, but as I stated I like to build my program dictionary up a bit. A lot program are good, but this one that I wrote have gives me a look at where the attacks are from from and breaks it down by country.</div>
<div><br></div><div>Example, this was just from yesterday <br></div><div><br></div><div>110.172.52.45 2012-10-09 15:42:27 (Unknown city), INDIA<br>69.94.125.45 2012-10-09 15:42:29 Sacramento, CA, UNITED STATES<br>
112.114.63.139 2012-10-09 15:42:31 (Unknown City?), (Unknown Country?)<br>113.17.144.156 2012-10-09 15:42:33 Nanning, CHINA<br>150.214.150.39 2012-10-09 15:42:35 Sevilla, SPAIN<br><a href="tel:60.164.231.86" value="+16016423186" target="_blank">60.164.231.86</a> 2012-10-09 15:42:37 (Unknown city), CHINA<br>
85.182.191.230 2012-10-09 15:42:39 (Unknown city), GERMANY<br>96.53.46.230 2012-10-09 15:42:41 (Unknown City?), (Unknown Country?)<br>124.81.236.52 2012-10-09 16:30:04 Jakarta, INDONESIA<br>190.254.222.138 2012-10-09 17:30:03 (Unknown City?), (Unknown Country?)<br>
119.97.246.18 2012-10-09 19:30:03 (Unknown City?), (Unknown Country?)<br>187.115.132.13 2012-10-09 20:45:03 (Unknown City?), (Unknown Country?)<br>200.189.233.122 2012-10-09 21:45:03 Curitiba, BRAZIL</div><div><br></div>
<div><br></div><div>Top 10 Countries<br> Country # of Attacks <br> (Unknown Country?) 331<br> CHINA 196<br> UNITED STATES 126<br> KOREA, REPUBLIC OF 31<br> BRAZIL 26<br> FRANCE 21<br> GERMANY 21<br> INDIA 20<br> ITALY 20<br>
AUSTRALIA 18</div><div><br></div><div>Thanks for the info. By the way, why reinvent the wheel because we all thought like that, we still be using wheels made of stone. It it better to try and fail, than to sit and listen to people not to try. ( A monk told me that in College. )<br>
</div><div><div><br><div class="gmail_quote">On Tue, Oct 9, 2012 at 9:16 PM, JD <span dir="ltr"><<a href="mailto:jdp@algoloma.com" target="_blank">jdp@algoloma.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Backtrack <a href="http://www.backtrack-linux.org/" target="_blank">http://www.backtrack-linux.org/</a> and metaspoit<br>
<a href="http://www.metasploit.com/" target="_blank">http://www.metasploit.com/</a> are what you want.<br>
<div><br>
On 10/09/2012 03:57 PM, Chuck Payne wrote:<br>
> I am trying to build a dictionary of common attacks against apache so that I can<br>
> run a script against it and scrape out the ip.<br>
><br>
><br>
</div><div><div>_______________________________________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org" target="_blank">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
</div></div></blockquote></div><br><br clear="all"><br></div></div><div><div>-- <br>Terror PUP a.k.a<br>Chuck "PUP" Payne<br> <br><a href="tel:%28678%29%20636-9678" value="+16786369678" target="_blank">(678) 636-9678</a><br>
-----------------------------------------<br>
Discover it! Enjoy it! Share it! openSUSE Linux.<br>
-----------------------------------------<br>openSUSE -- <a href="http://en.opensuse.org/User:Terrorpup" target="_blank">en.opensuse.org/User:Terrorpup</a><br>openSUSE Ambassador/openSUSE Member<br>Community Manager -- Southeast Linux Foundation (SELF)<br>
skype,twiiter,identica,friendfeed -- terrorpup<br>freenode(irc) --terrorpup/lupinstein<br>Register Linux Userid: 155363<br> <br>Have you tried SUSE Studio? Need to create a Live CD, an app you want to package and distribute , or create your own linux distro. Give SUSE Studio a try. <a href="http://www.susestudio.com" target="_blank">www.susestudio.com</a>.<br>
See you at Southeast Linux Fest, June 8-10, 2012 in Charlotte, NC. <a href="http://www.southeastlinuxfest.org" target="_blank">www.southeastlinuxfest.org</a><br>
</div></div><br>_______________________________________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org" target="_blank">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
<br></blockquote></div><br><br clear="all"><br>-- <br></div></div><span class="HOEnZb"><font color="#888888">-- <br>James P. Kinney III<br><i><i><i><i><br></i></i></i></i>Every time you stop a school, you will have to build a jail. What you
gain at one end you lose at the other. It's like feeding a dog on his
own tail. It won't fatten the dog.<br>
- Speech 11/23/1900 Mark Twain<br><i><i><i><i><br><a href="http://electjimkinney.org" target="_blank">http://electjimkinney.org</a><br><a href="http://heretothereideas.blogspot.com/" target="_blank">http://heretothereideas.blogspot.com/</a><br>
</i></i></i></i><br>
</font></span></blockquote></div><br><br clear="all"><br>-- <br>-- <br>James P. Kinney III<br><i><i><i><i><br></i></i></i></i>Every time you stop a school, you will have to build a jail. What you
gain at one end you lose at the other. It's like feeding a dog on his
own tail. It won't fatten the dog.<br>
- Speech 11/23/1900 Mark Twain<br><i><i><i><i><br><a href="http://electjimkinney.org" target="_blank">http://electjimkinney.org</a><br><a href="http://heretothereideas.blogspot.com/" target="_blank">http://heretothereideas.blogspot.com/</a><br>
</i></i></i></i><br>