Looking at my IIS logs from Godaddy, I can get hundreds of 404 errors a day, where either some script kiddies or bots are constantly looking for vulnerabilities or pages/directories to exploit. Besides a lot of directory search attempts and non existent php pages, I see an unusual number of probings for a file called ".env" in various directories. Does anyone know what this file is for that is being searched for?
3
-
You should consider enabling Request Filtering so that malicious requests don't even make it to the application. Depending on your application you could block particular file extensions from being requested, or excessive url lengths or whatever. There's probably a newer doc somewhere, but this is the one I found: docs.microsoft.com/en-us/iis/manage/configuring-security/…– Altimus PrimeJun 10, 2020 at 19:14
-
I'll have to call GoDaddy. It doesn't seem to be available from their Plesk Administration. I'd like to filter out all PHP requests as well.– SteveFergJun 10, 2020 at 19:18
-
1Get used to it. Every single IPv4 address is constantly probed for every conceivable vulnerability. It's a waste of time to try finding out what they are after. It could be an old vulnerability of some appliance you never even heard about, or some old CMS that has long gone out of fashion. The script kiddies just don't care about the noise they generate. They will happily send out billions of probes on the off-chance that one of them will hit home. Your best bet is to turn that against them and block any source address producing too many 404s in quick succession.– Tilman SchmidtJun 10, 2020 at 23:12
Add a comment
|
1 Answer
Usually a .env file is a plain text file used to store environment variables to configure certain software. It looks like this:
APP_NAME="My app"
APP_ENV=production
It is useful to avoid mixing secrets (like passwords, tokens, etc) and source code.
