Blocking apache access via user agent string

Posted by Tchalvak on Server Fault See other posts from Server Fault or by Tchalvak
Published on 2011-03-25T20:51:50Z Indexed on 2012/10/28 23:06 UTC
Read the original article Hit count: 252

Filed under:

blacklist

|

useragent

|

intrusion-prevention

I've got a scripter who is using a proxy to attack a website I'm serving.

I've noticed that they tend to access the site via software with a certain common user agent string (i.e. http://www.itsecteam.com/en/projects/project1_page2.htm "Havij advanced sql injection software" with a user_agent string of Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Havij). I'm aware that any cracking software worth it's salt will probably be able to modify it's user agent string, but I'm fine with the scripter having to deal with that feature at some point.

So, is there any software out there for automatically blocking access & permanently blacklisting by matching user agent strings?

© Server Fault or respective owner

Related posts about blacklist

Ubuntu doesn't let me to blacklist modules

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I'd like to blacklist a couple of modules, namely drm, drm_kms_helper, i2c_algo_bit and i915 to not allow my integrated Intel GPU to ever be used, but instead my Nvidia MXM card. I inserted the following lines into /etc/modprobe.d/blacklist.conf: blacklist i915 blacklist drm blacklist drm_kms_helper blacklist… >>> More
Modules loading despite being added to the blacklist

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I'd like to blacklist a couple of modules, namely drm, drm_kms_helper, i2c_algo_bit and i915 to forbid my integrated Intel GPU to be used, but to use my Nvidia MXM card instead. I inserted the following lines into /etc/modprobe.d/blacklist.conf: blacklist i915 blacklist drm blacklist drm_kms_helper blacklist… >>> More
wifi not recognized

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I had wifi and worked then some day ubuntu asked me to update some packeages and restarted the system and after that no wifi. this is my wireless_script output : ########## wireless info START ########## ##### release ##### Distributor ID: Ubuntu Description: Ubuntu 14.04 LTS Release: 14… >>> More
Blacklist number range [closed]

as seen on Super User - Search for 'Super User'
I have a jailbroken iPhone and I'd like to blacklist/block a range of phone numbers, for example, 4102* — is there "an app for that"? Thanks >>> More
Wireless Problem on Acer Aspire 5610z

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I installed ubuntu 12.04 on my machine, but I can't get wireless connection to work. My computer is Acer Aspire 5610z. I found that some other people that have same computer, face the same problem. Here is some information about it: ****** info trace ****** * uname -a * Linux ucy-Aspire-5610Z… >>> More

Related posts about useragent

WP plugin based on useragent

as seen on Stack Overflow - Search for 'Stack Overflow'
I am writing a plugin which does some js stuff, but does not work for other browsers than FF . I've thought why not execute the plugin for the browsers which support it. I've added the code, but for some reason when I activate the plugin and check the site with a FF all I get is blank page. If I visit… >>> More
Alter Regular Expression to Return 2 Values Instead of 3 from userAgent String

as seen on Stack Overflow - Search for 'Stack Overflow'
I've taken a regular expression from jQuery to detect if a browser's engine is WebKit and gets it's version number, it returns 3 values extracted from the userAgent string: webkit/….…, webkit and ….… [“….…” being the version number]. I would like the regular expression to return just 2 values: webkit… >>> More
HttpWebRequest.UserAgent : What does it do

as seen on Stack Overflow - Search for 'Stack Overflow'
I read this MSDN like about it and ran its example. when I change the uSerAgnet to something like "blah", the output is wrong but when I use the same thing that is in the example of even when I comment out the line of code that is setting the UserASgent, the output is correct. what is UserAgent at… >>> More
Spoofing UserAgent in Opera

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm trying to spoof Opera (under linux) to be an other browser, in this case iPad for some testing purposes. Now I know sites can check which browser is accessing the using for example in PHP $useragent = $_SERVER['HTTP_USER_AGENT']; and in javascript navigator.userAgent (or navigator.platform). In… >>> More
Massive Crawling requests from Google Apps Engine useragent

as seen on Server Fault - Search for 'Server Fault'
Hi friends, I'm badly affected with 'Google AppEngine-Google' UserAgent.. receiving 5/6 requests per second on http server. This bot is crawling my site just like GoogleBot does. Following is the sample of url in my access logs. 72.14.192.3 - - [19/May/2010:01:27:06 +0000] "GET /some-url/etc-123… >>> More