up vote 1 down vote favorite
share [g+] share [fb]

I'd like to block malformed requests like these:

79.26.188.208 - - [05/Apr/2011:13:47:38 +0200] "\xae\xe1\x0fi\xca\xeba\xdfm\x9d\xb5\xc0yr-n\x05Z\x9f\xa7\x05\xa1g" 200 4855 "-" "-"
82.51.130.83 - - [05/Apr/2011:18:25:38 +0200] "T\xd0\xc55\xc3A\xcd\xd0" 200 4855 "-" "-"

What is the preferred method?

link|improve this question
86% accept rate
feedback

2 Answers

up vote 1 down vote

mod_security is useful for blocking many of these requests.

It detects known exploit patterns and blocks them.

link|improve this answer
@Mikel: I'm already using mod_security, but what should I filter for? Requests without GET/POST? – Joril Apr 7 '11 at 13:37
This is not necessarily a known exploit pattern. Some googling shows that these requests can come from legitimate sources. To see why Apache is printing these characters in the logfile, see httpd.apache.org/docs/2.2/mod/mod_log_config.html#format-notes – Stefan Lasiewski Apr 7 '11 at 16:49
@Stefan Lasiewski: I see, but those requests are making my CMS (Silverstripe) throw tons of warnings, so I'd like to block them out :) – Joril Apr 13 '11 at 6:54
1  
@Joril: Actually, we are using Silverstripe as well, and I haven't noticed that sort of request yet (We have a very effective IDS, and we get attacked constantly, so the IDS might be blocking the bad IPs after a few requests). Let me look and see if we are actually getting those requests. – Stefan Lasiewski Apr 13 '11 at 17:16
1  
Anyway I added this rule: SecRule REQUEST_METHOD "!^(?:GET|HEAD|OPTIONS|POST|CONNECT)$" and it looks like it's working :) – Joril Apr 13 '11 at 18:47
show 2 more comments
feedback
up vote 1 down vote accepted

Following Mikel's lead I added this mod_security rule

SecRule REQUEST_METHOD "!^(?:GET|HEAD|OPTIONS|POST|CONNECT)$"

and now only legitimate requests pass through.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.