“Toata dragostea mea pentru” Vulnerability Scanners

#1 2009-02-26 by baffled

Mine is checking for the Coppermine photo gallery and similar software or varied paths to photo galleries. Thanks for all the hints. Without them, here and anywhere else, I would not even have been able to set-up my .htaccess file. I still hope, my hosting provider will do the rest.

#2 2009-02-26 by Johann

baffled,

thanks for your comment. Good to see you're blocking this.

#3 2009-03-13 by Dan

One of my server got scaned but as I had mod_security installed and configured all requests got a 400 error... and not only this kind of scans got blocked. Rules cand be easy understand and customised by any server administrator.

#4 2009-03-13 by Johann

Dan,

I've heard about mod_security before. Do you find it useful? How much abuse does it stop? Just scanning and exploits or also comment spam?

#5 2009-03-13 by Dan

Hello Johann,

ModSecurity core rules can do many things, like blocking/loging protocol violation and anomalies, seting request limit, blocking bad robots (like email harvesters), blocking generic attacks (eg. sql injection and XSS), blocking backdor access, block information leakage.
And it also have rules to block SPAM comments.
There is also possible to make Apache scan all files uploaded using antivirus software (eg. amavis).
Separate, there is a ModSecurity Console (screenshot http://img27.imageshack.us/img27/3900/picture3avh.png) that can be used to analise the problems ocured. Personaly i love it :)
Another screenshot: http://img149.imageshack.us/img149/5052/86495002.jpg

#6 2009-03-14 by Dan

I just remembered something, as i said you can make Apache scan all files with an antivirus using mod_security, a file on yahoo's geocities... http://br.geocities.com/thalesnn/r57.txt
I found this file some days ago... and it is still there... i wonder what the hell yahoo work on that is so important that his servers are used to exploit other servers security isues...
So, i recomand again using mod_security (as it is free and easy to install) just to not go like yahoo...

#7 2009-03-18 by Johann

Dan,

that's a well-known backdoor that is used by vulnerability scanners as payload.

They're hosted here and there, some hosts remove them, some don't.

#8 2009-03-23 by Dan

Yes Johann, but as a server admin you must take care of your security, and also prevent the use of your server for this kind of things... At least that's my point of view...

#9 2009-04-02 by Johann

Dan,

I agree but as you can see, some people don't care.

#10 2010-01-05 by Nico

My homeserver was also scanned by this thing. But i dont know which pages where checked (my sw does not link pages with browsers) The using Name of it was: "Toata dragostea mea pentru diavola". What's the reason of these things?

#11 2010-01-07 by Johann

Nico,

these people are looking for bugs in software that you have installed on your software. More specifically, they're looking for bugs that let them abuse your server to host their material or send email spam.