Protect from w00tw00t.at.blackhats.romanian.anti-sec

What the hell? I recently purchased some server in Digital Ocean and found the w00tw00t.at.blackhats.romanian.anti-sec attack. The same kind of attack I also found in my AWS EC2 servers.

w00tw00t.at.blackhats.romanian.anti-sec is kind of script attack in which attacker try to find the loopholes in phpmyadmin and php with Apache and try to manipulate through URL.
The same thing I found in my client system who have recently been migrated to Digital Ocean because of its very reasonable price.

[root@server log]# grep -r w00t *
httpd/access_log-20130623:203.156.205.160 – – [21/Jun/2013:10:15:42 +0000] “GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1” 301 354 “-” “ZmEu”
httpd/access_log-20130623:203.156.205.160 – – [21/Jun/2013:18:24:07 +0000] “GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1” 301 354 “-” “ZmEu”
httpd/access_log-20130623:203.156.205.160 – – [21/Jun/2013:18:24:09 +0000] “GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1” 301 354 “-” “ZmEu”
httpd/access_log-20130623:108.161.129.137 – – [22/Jun/2013:21:46:59 +0000] “GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1” 301 354 “-” “ZmEu”
[root@server log]#

Solution :

(1) To deal with this issue I have set the iptable based on string. As well as I putted Anti portscan iptable script.

iptables -I INPUT -p tcp --dport 80 -m string --to 60 --algo bm --string 'GET /w00tw00t' -j DROP

(2) Implement fail2ban . (I have not written post on it)

Create a new file in /etc/fail2ban/filter.d/ called “w00tw00t.conf”

vi /etc/fail2ban/filter.d/w00tw00t.conf

[Definition]

failregex = ^ .*"GET /w00tw00t*

ignoreregex =

Edit /etc/fail2ban/jail.conf file and after last line put this configuration & restart the fail2ban service

vi /etc/fail2ban/jail.conf

[w00tw00t-scans]

enabled  = true

action   = iptables-allports

sendmail-whois[name=SSH, dest=root, sender=fail2ban@example.com]

filter   = w00tw00t

##### set the log path ######

logpath  = /var/log/httpd/access_log

maxretry = 1

###### ban for 24 hour ######

bantime  = 86400

There are some other measures I am looking forward to protect my server from such attack.
Currently parsing apache the error.log and banned the attacking IP address in iptable
Checking some more fail2ban regex to deal with this issue.

Putting the Nagios monitoring for this particular attack.

Till now the server is safe and all the above measures are working fine.