I noticed a bunch of those w00tw00t requests coming to my Ubuntu 12.04 server and so I installed fail2ban. I followed these instructions on setting up Fail2ban against w00tw00t requests. I made sure to name the files properly, and restart fail2ban after the configuration was changed.
I tested by typing in various w00tw00t
parameters in my URL just like the attackers do, but none would ban me. I did not add my IP to a list of ignore. I even tried from my phone, still no ban.
In jail.conf I have the following located in /etc/fail2ban/jail.conf
[w00tw00t-scans]
enabled = true
action = iptables-allports
sendmail-whois[name=SSH, dest=ubuntu, [email protected]]
filter = w00tw00t
logpath = /var/log/apache2/access.log
maxretry = 1
bantime = 120 #testing so that I can verify and not be banned for a day!
Here is w00tw00t filter located in /etc/fail2ban/filter.d/w00tw00t.conf
#block w00tw00t scans of all variations
[Definition]
failregex = ^<HOST> .*”GET \/w00tw00t*
ignoreregex =
I verified that the log path is set correctly by typing in an obscure parameter in my URL, then checked access.log and sure enough it was there. I also made sure to restart fail2ban afterward I added the rules.
Is there any other setup I need to do out of the box with fail2ban? After I installed the only thing I did was add the filter and the wootwoot bit to jail.conf. I checked to make sure it's running by typing /etc/init.d/fail2ban start
and it responds with * Socket file /var/run/fail2ban/fail2ban.sock is present
edit - just showing what the request looks like on /var/log/apache2/access.log
Here's a malicious request
67.215.248.8 - - [12/Feb/2014:18:59:42 +0000] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 404 1997 "-" "ZmEu"
And here's a request I made
My.IP.Address - - [12/Feb/2014:21:41:13 +0000] "GET /w00tw00t HTTP/1.1" 404 1928 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.107 Safari/537.36"