Code Monkey home page Code Monkey logo

bot-feeder-www's Introduction

bot-feeder-www

My way of dealing with exploit bots that attack our WWW servers.

WARNING: NOT ALL TECHNIQUES ARE USEFUL TO YOUR WEBSITE

Step 1. Locate the issue...

149.28.132.x - - [28/Apr/2022:06:54:15 -0500] "GET / HTTP/1.1" 200 65764
149.28.132.x - - [28/Apr/2022:06:54:20 -0500] "GET / HTTP/1.1" 200 65787
149.28.132.x - - [28/Apr/2022:06:54:25 -0500] "GET /wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
149.28.132.x - - [28/Apr/2022:06:54:25 -0500] "GET /xmlrpc.php?rsd HTTP/1.1" 404 59
149.28.132.x - - [28/Apr/2022:06:54:26 -0500] "GET / HTTP/1.1" 200 65788
149.28.132.x - - [28/Apr/2022:16:13:34 -0500] "GET /wp-login.php HTTP/1.1" 404 59
149.28.132.x - - [28/Apr/2022:06:54:29 -0500] "GET /blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
149.28.132.x - - [28/Apr/2022:06:54:29 -0500] "GET /web/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
149.28.132.x - - [28/Apr/2022:06:54:30 -0500] "GET /wordpress/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
149.28.132.x - - [28/Apr/2022:06:54:30 -0500] "GET /website/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
149.28.132.x - - [28/Apr/2022:06:54:30 -0500] "GET /wp/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
149.28.132.x - - [28/Apr/2022:06:54:31 -0500] "GET /news/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
149.28.132.x - - [28/Apr/2022:06:54:31 -0500] "GET /2018/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
149.28.132.x - - [28/Apr/2022:06:54:31 -0500] "GET /2019/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
149.28.132.x - - [28/Apr/2022:06:54:32 -0500] "GET /shop/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
149.28.132.x - - [28/Apr/2022:06:54:32 -0500] "GET /wp1/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
149.28.132.x - - [28/Apr/2022:06:54:32 -0500] "GET /test/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
149.28.132.x - - [28/Apr/2022:06:54:33 -0500] "GET /media/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
149.28.132.x - - [28/Apr/2022:06:54:33 -0500] "GET /wp2/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
149.28.132.x - - [28/Apr/2022:06:54:33 -0500] "GET /site/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
149.28.132.x - - [28/Apr/2022:06:54:34 -0500] "GET /cms/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
149.28.132.x - - [28/Apr/2022:06:54:34 -0500] "GET /sito/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59

Step 2. Come up with solution...

#### Create the file location and file they are searching.
#### So for instance if they are searching /wp-login.php on a NON wordpress page.
#### Create /wp-login.php + /loop.php
##### loop.php <?php echo "<meta http-equiv='refresh' content='0;url=wp-login.php'>"; ?>
##### wp-login.php <?php echo "<meta http-equiv='refresh' content='0;url=loop.php'>"; ?>

/wp-login.php HTTP/1.1" 404 59
/ HTTP/1.1" 200 65764
/ HTTP/1.1" 200 65787
/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
/xmlrpc.php?rsd HTTP/1.1" 404 59
/ HTTP/1.1" 200 65788
/blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
/web/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
/wordpress/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
/website/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
/wp/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
/news/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
/2018/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
/2019/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
/shop/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
/wp1/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
/test/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
/media/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
/wp2/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
/site/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
/cms/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59
/sito/wp-includes/wlwmanifest.xml HTTP/1.1" 404 59

Step 3. Do this for all the following PHP searches that exploit bots are seeking.

bot-feeder-www's People

Contributors

codelyfe avatar

Watchers

avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.