I have a nginx proxy facing public internet. A few days ago, I started to receive a torrential amount of requests, targeting URLs that are invalid for my domain.

An excerpt from nginx access.log: - - [07/Feb/2014:10:45:26 +0000] "GET http://ads.yahoo.com/st?ad_type=iframe&ad_size=300x250&section=5306841&pub_url=${PUB_URL} HTTP/1.0" 301 184 "http://www.echogap.com/index.php?option=com_content&view=article&id=1383:Credit-Report---How-Do-Late-Payments-Affect-My-Credit-Report-And-Score?&catid=154" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/125.2 (KHTML, like Gecko) Safari/125.8"

Some points I need help understanding / solving:

  • Why does the request url contains the full url with domain name, instead of the usual path only ?
  • How is it possible that requests that are not even targeting my domain reaches my server (.i.e, ads.yahoo.com) ?
  • What would be the best way to avoid serving these requests ? I guess blacklisting the originated ips is out of question, since the requests come from a LOT of different addresses.
  • Does the described scenario mean an explicit attack ?

It seems like they are trying to use your web server as an open proxy. As long as you don't see your servers responding with a 200 OK, you shouldn't be worried.


Although there may be ways to handle this with builtin nginx functionality, I found easier to install/enable mod_security and let him handle this and other nasty attacks. As you'll see in the logs below, somebody is trying to reach wikipedia through my server, mod_security knows that this this is an anomaly an takes an appropriate action (It returns a 403 forbidden response). This is an Apache server but it should be exactly the same in nginx.

[03/Feb/2014:22:26:01 +0300] Uu-tScDjiOsAAALeENQAAAAA 52735 80
GET http://wikipedia.pl HTTP/1.1
Host: wikipedia.pl
Accept: */*
Proxy-Connection: Keep-Alive

HTTP/1.1 403 Forbidden
Content-Length: 202
Connection: close
Content-Type: text/html; charset=iso-8859-1


Message: Access denied with code 403 (phase 1). Match of "rx ^(?i:(?:[a-z]{3,10}\\s+(?:\\w{3,7}?://[\\w\\-\\./]*(?::\\d+)?)?/[^?#]*(?:\\?[^#\\s]*)?(?:#[\\S]*)?|connect (?:\\d{1,3}\\.){3}\\d{1,3}\\.?(?::\\d+)?|options \\*)\\s+[\\w\\./]+|get /[^?#]*(?:\\?[^#\\s]*)?(?:#[\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/httpd/modsecurity.d/activated_rules/modsecurity_crs_20_protocol_violations.conf"] [line "52"] [id "960911"] [rev "2"] [msg "Invalid HTTP Request Line"] [data "GET http://wikipedia.pl HTTP/1.1"] [severity "WARNING"] [ver "OWASP_CRS/2.2.6"] [maturity "9"] [accuracy "9"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ"] [tag "CAPEC-272"]
Action: Intercepted (phase 1)
Stopwatch: 1391455561096692 260049 (- - -)
Stopwatch2: 1391455561096692 260049; combined=104238, p1=104194, p2=0, p3=0, p4=0, p5=43, sr=104028, sw=1, l=0, gc=0
Response-Body-Transformed: Dechunked
Producer: ModSecurity for Apache/2.7.3 (http://www.modsecurity.org/); OWASP_CRS/2.2.6.
Server: Apache
Engine-Mode: "ENABLED"

* = I replaced my IP address with this fake IP. I don't need any more strange packets knocking my door :)

  • Thanks for pointing out Gabriel. Researching on a solution on "how to avoid being an open proxy" I stumbled upon the valid_referers nginx directive. The way I see it, returning 403 instead of 302 on these hop-requests should make my server less appropriate for the job of being an open proxy, and maybe stop being used as such at all (please correct me if I am wrong).
    – ccortezia
    Feb 8 '14 at 20:52
  • Anyway, I cannot mark your answer right just yet. Some points raised on the question are still opened. Let's wait a bit longer.
    – ccortezia
    Feb 8 '14 at 20:53
  • You are correct, returning 403 will be the safer way to handle this. Please see the update in my reply. Feb 8 '14 at 21:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.