|
最近发现一些非法请求日志，非法请求，非法ip 183.60.244.30 - - [20/Nov/2015:12:20:08 +0800] "GET /User/Login.aspx HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:08 +0800] "GET /License.txt HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:08 +0800] "GET /API/DW/Dwplugin/TemplateManage/manage_site.htm HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:08 +0800] "GET /API/DW/Dwplugin/TemplateManage/save_template.htm HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:08 +0800] "GET /API/DW/Dwplugin/ThirdPartyTags/SiteFactory.xml HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:08 +0800] "GET /Admin/Common/HelpLinks.xml HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:08 +0800] "GET /API/DW/Dwplugin/TemplateManage/login_site.htm HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:08 +0800] "GET /API/DW/Dwplugin/SystemLabel/SiteConfig.htm HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:08 +0800] "GET /Admin/Login.aspx HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:06 +0800] "GET /issmall HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:06 +0800] "GET /favicon.ico HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:06 +0800] "GET /images/login-page.gif HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:06 +0800] "GET /cgi-mod/header_logo.cgi HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:06 +0800] "GET /images/powered_by.gif HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:06 +0800] "GET /favicon.ico HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:07 +0800] "GET /web-console HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:07 +0800] "GET /admin-console HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:07 +0800] "GET /manager/status HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:07 +0800] "GET /manager/html HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:07 +0800] "GET /manager/status HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:07 +0800] "GET /?c=4e5e5d7364f443e28fbf0d3ae744a59a HTTP/1.1" 200 612 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:07 +0800] "GET /doku.php HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:07 +0800] "GET /shop/ HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:07 +0800] "GET /shops/ HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:07 +0800] "GET /shop/ HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:07 +0800] "GET /mall/ HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:07 +0800] "GET /eshop/ HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:07 +0800] "GET /shops/ HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:07 +0800] "GET /ecshop/ HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:07 +0800] "GET /skin/frontend/default/modern/css/styles.css HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:08 +0800] "GET /stylesheet.css HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 183.60.244.30 - - [20/Nov/2015:12:20:08 +0800] "GET /includes/general.js HTTP/1.1" 404 570 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" "-" 什么.asp,php等请求，这些本系统都没有，明显是非法请求，查询漏洞的非法请求。 解决办法：1、禁止掉183.60.244.30。 （1）在/etc/nginx/conf.d创建blocksip.conf文件 （2）在blocksip.conf文件中禁止掉183.60.244.30。常见参数解释 deny 183.60.244.30;禁止某一个ip访问 allow 182.18.1.1 允许某一个ip访问 deny all 禁止所有访问 allow all允许所有访问
#封整个段即从123.0.0.1到123.255.255.254的命令 deny 123.0.0.0/8 #封IP段即从123.45.0.1到123.45.255.254的命令 deny 124.45.0.0/16 #封IP段即从123.45.6.1到123.45.6.254的命令是 deny 123.45.6.0/24 2、nginx禁止一些非法请求 server {
listen 80; ## listen for ipv4 server_name www.cookqq.com cookqq .com ...... location ~ \.(asp|php|aspx|xslt|do)$ { return 404; } } 测试方法在浏览器中数据www.cookqq.com/test.asp,浏览器显示404
|
