attaques web

par **fireman** » 01 Juil 2002 20:16

Je viens d'installer un Firewall ipcop dans mon réseau. 3 cartes réseau. Un serveur Web tourne dans le réseau privé (pas dans la DMZ), en ayant activé le port forwarding (port 80). Tout marche bien jusqu'au moment où je consulte les logs d'intrusion. Pas moins de 25 attaques web en +- 2h détectées par SNORT. Question : Quand snort détecte les intrusions, les bloque-t-il ? Autre question : j'ai placé le serveur web (apache sous windows 2000) sur le réseau interne car le site web (écrit en php) possède des liens odbc vers access, mais aussi requiert des mappings réseaux vers d'autres serveurs du réseau interne. Y aurait-il moyen de le placer dans la DMZ en conservant les liens ODBC et ces mappings ? Si qqun a une réponse, je suis toutoui.. hoho

par **fireman** » 01 Juil 2002 20:34

voila le genre d'attaques que j'ai eu : WEB-IIS CodeRed v2 root.exe access Est-ce grave, docteur ? Est-ce courant ?

par **drlin** » 01 Juil 2002 23:33

aucun problemes.... l'attaque est destiné au serveurs Winxx et NT. Donc pas de problèmes pour toi... <IMG SRC="images/smiles/icon_up.gif">

par **fireman** » 02 Juil 2002 08:19

Voici les logs des attaques que j'ai eu : IPCop IDS snort log Date: 1 July Date: 07/01 12:34:01 Name: WEB-MISC Compaq Insight directory traversal Priority: 1 Type: Web Application Attack IP Info: 212.190.147.35:80 -> 192.168.1.2:2301 Refs: Date: 07/01 12:34:02 Name: WEB-MISC Compaq Insight directory traversal Priority: 1 Type: Web Application Attack IP Info: 212.190.147.35:80 -> 192.168.1.2:2301 Refs: Date: 07/01 12:55:50 Name: WEB-IIS CodeRed v2 root.exe access Priority: 1 Type: Web Application Attack IP Info: 193.252.122.130:4861 -> 192.168.1.2:80 Refs: Date: 07/01 12:55:50 Name: WEB-IIS cmd.exe access Priority: 1 Type: Web Application Attack IP Info: 193.252.122.130:4885 -> 192.168.1.2:80 Refs: Date: 07/01 12:55:50 Name: WEB-IIS cmd.exe access Priority: 1 Type: Web Application Attack IP Info: 193.252.122.130:4889 -> 192.168.1.2:80 Refs: Date: 07/01 12:55:50 Name: WEB-IIS cmd.exe access Priority: 1 Type: Web Application Attack IP Info: 193.252.122.130:4894 -> 192.168.1.2:80 Refs: Date: 07/01 12:55:50 Name: WEB-FRONTPAGE /_vti_bin/ access Priority: 2 Type: access to a potentially vulnerable web application IP Info: 193.252.122.130:4900 -> 192.168.1.2:80 Refs: Date: 07/01 12:55:50 Name: WEB-IIS cmd.exe access Priority: 1 Type: Web Application Attack IP Info: 193.252.122.130:4903 -> 192.168.1.2:80 Refs: Date: 07/01 12:55:51 Name: WEB-IIS cmd.exe access Priority: 1 Type: Web Application Attack IP Info: 193.252.122.130:4906 -> 192.168.1.2:80 Refs: Date: 07/01 12:55:51 Name: WEB-IIS cmd.exe access Priority: 1 Type: Web Application Attack IP Info: 193.252.122.130:4913 -> 192.168.1.2:80 Refs: Date: 07/01 12:55:51 Name: WEB-IIS cmd.exe access Priority: 1 Type: Web Application Attack IP Info: 193.252.122.130:4925 -> 192.168.1.2:80 Refs: Date: 07/01 12:55:51 Name: WEB-IIS cmd.exe access Priority: 1 Type: Web Application Attack IP Info: 193.252.122.130:4926 -> 192.168.1.2:80 Refs: Date: 07/01 12:55:51 Name: WEB-IIS cmd.exe access Priority: 1 Type: Web Application Attack IP Info: 193.252.122.130:4929 -> 192.168.1.2:80 Refs: Date: 07/01 12:55:51 Name: WEB-IIS cmd.exe access Priority: 1 Type: Web Application Attack IP Info: 193.252.122.130:4931 -> 192.168.1.2:80 Refs: Date: 07/01 12:55:51 Name: WEB-IIS cmd.exe access Priority: 1 Type: Web Application Attack IP Info: 193.252.122.130:4933 -> 192.168.1.2:80 Refs: Date: 07/01 12:55:51 Name: WEB-IIS cmd.exe access Priority: 1 Type: Web Application Attack IP Info: 193.252.122.130:4944 -> 192.168.1.2:80 Refs: Date: 07/01 12:55:51 Name: WEB-IIS cmd.exe access Priority: 1 Type: Web Application Attack IP Info: 193.252.122.130:4945 -> 192.168.1.2:80 Refs: Date: 07/01 15:17:59 Name: WEB-IIS cmd.exe access Priority: 1 Type: Web Application Attack IP Info: 212.247.101.22:3506 -> 192.168.1.2:80 Refs: Date: 07/01 15:51:34 Name: WEB-MISC sadmind worm access Priority: 2 Type: Attempted Information Leak IP Info: 61.240.98.27:38967 -> 192.168.1.2:80 Refs: Date: 07/01 15:51:38 Name: WEB-MISC sadmind worm access Priority: 2 Type: Attempted Information Leak IP Info: 61.240.98.27:38967 -> 192.168.1.2:80 Refs: Date: 07/01 16:20:55 Name: WEB-IIS _vti_inf access Priority: 2 Type: access to a potentially vulnerable web application IP Info: 193.190.136.62:8110 -> 192.168.1.2:80 Refs: Date: 07/01 16:20:55 Name: WEB-IIS _vti_inf access Priority: 2 Type: access to a potentially vulnerable web application IP Info: 193.190.136.62:8171 -> 192.168.1.2:80 Refs: Date: 07/01 16:20:55 Name: WEB-FRONTPAGE _vti_rpc access Priority: 2 Type: access to a potentially vulnerable web application IP Info: 193.190.136.62:8212 -> 192.168.1.2:80 Refs: Date: 07/01 16:20:55 Name: WEB-FRONTPAGE _vti_rpc access Priority: 2 Type: access to a potentially vulnerable web application IP Info: 193.190.136.62:8214 -> 192.168.1.2:80 Refs: Date: 07/01 16:20:55 Name: WEB-IIS _vti_inf access Priority: 2 Type: access to a potentially vulnerable web application IP Info: 193.190.136.62:8215 -> 192.168.1.2:80 Refs: Date: 07/01 16:20:55 Name: WEB-IIS _vti_inf access Priority: 2 Type: access to a potentially vulnerable web application IP Info: 193.190.136.62:8217 -> 192.168.1.2:80 Refs: Date: 07/01 16:20:55 Name: WEB-FRONTPAGE _vti_rpc access Priority: 2 Type: access to a potentially vulnerable web application IP Info: 193.190.136.62:8218 -> 192.168.1.2:80 Refs: Date: 07/01 16:20:55 Name: WEB-FRONTPAGE _vti_rpc access Priority: 2 Type: access to a potentially vulnerable web application IP Info: 193.190.136.62:8219 -> 192.168.1.2:80 Refs: Date: 07/01 16:30:27 Name: WEB-MISC readme.eml attempt Priority: 1 Type: Attempted User Privilege Gain IP Info: 206.103.225.241:80 -> 192.168.1.2:1891 Refs: Date: 07/01 17:54:59 Name: WEB-IIS cmd.exe access Priority: 1 Type: Web Application Attack IP Info: 166.102.22.195:3335 -> 192.168.1.2:80 Refs: Date: 07/01 19:39:53 Name: WEB-MISC admin.php access Priority: 2 Type: Attempted Information Leak IP Info: 80.200.18.224:1078 -> 192.168.1.2:80 Refs: Date: 07/01 19:40:01 Name: WEB-MISC admin.php access Priority: 2 Type: Attempted Information Leak IP Info: 80.200.18.224:1080 -> 192.168.1.2:80 Refs: Date: 07/01 19:40:05 Name: WEB-MISC admin.php access Priority: 2 Type: Attempted Information Leak IP Info: 80.200.18.224:1081 -> 192.168.1.2:80 Refs: Date: 07/01 19:40:50 Name: WEB-MISC admin.php access Priority: 2 Type: Attempted Information Leak IP Info: 80.200.18.224:1085 -> 192.168.1.2:80 Refs: Est-ce que snort les arrête ou est-ce qu'il les signale simplement ?

par **drlin** » 02 Juil 2002 16:41

ca c'est pas un virus/worm... c'est un plaisantain qui utilise un logiciel de recherche de failles de sécurité... c'est courant, j'en ai sur mon serveur plusieurs fois par semaines.... <IMG SRC="images/smiles/icon_cussing.gif">

attaques web

Qui est en ligne ?