Layer7 Attack Mitigation Development

[XURY]

Hello r4p3rs !

Spoiler: Information

This is intended for beginners
Just in case you're wondering why I'm showing obvious ways to mitigate Layer7 attacks

Today I wanted to show you an easy way to mitigate Layer7 attacks once you'll be victim of one!

First step:
Go to /var/log/nginx or /var/log/apache2 on your server and open the access log file as soon as the attack stops or slows down.

Second step:
Search for reoccuring strings.

Third step:
Immediately ban/blackhole websites that access your server with the previously discovered string.

Example:
http://thsec.net/mitigate-layer7-attacks/layer7-request-sample.php

As assumed by dedmen you probably won't know how to blackhole servers. Just in case you really don't know it there's a tutorial!

You're done !

 

[dedmen]

Beginners probably wont know how to ban/blackhole servers ^^

 

[XURY]

Beginners probably wont know how to ban/blackhole servers ^^

Yes, you're right I added a tutorial ^^ Thanks

 

[Qraktzyl]

What about

server {
...
if ($http_user_agent ~ WordPress) { return 444; }
...
}

with nginx?

 

[XURY]

What about

server {
...
if ($http_user_agent ~ WordPress) { return 444; }
...
}

with nginx?

I'm not familiar with nginx so that might work. Don't know if a request still gets into cache when thrown 444.