Hacker News Reader

Comment by mickael-kerjean | Hacker News Reader

I like to fool around those unwanted requests, sending back a randomly selected response among which: a gzip bomb, an xml bomb, specify gzip content encoding but send WAZAAAA in clear text instead, a redirect to localhost, redirect to their own public IP, sending back data whose content-length don't match what they're actually getting and a bunch of other shenanigans. The code is available on github [1], I'm super keen to add a bunch of other fun payload if someone has some clever ideas (without going onto a redirect to fbi, cia or anything that could cause more issues than what it's worth)

[1] https://github.com/mickael-kerjean/filestash/blob/master/ser...

View on HN

A fun and easy one for Nginx is to simply redirect all requests by default. I stick this in my default vhost after the healthcheck and error page parts :)

    location / {
        return 301 http://$remote_addr$request_uri;
        access_log /var/log/nginx/spam.log; 
    }

This also helps to separate the useless garbage requests from the real ones to keep the logs clean. 99% of the time scanners are hitting your IP rather than your hostname, so it's pretty safe to just ignore their requests entirely.

> without going onto a redirect to fbi

Redirect to FSB then.

But the more real one would be sending something what could be executed on their side, ie some JavaScript or maybe PHP.

Most of the time it's nothign to gain there (because compromised machines or VM/jail/container) but still can be interesting, like finding out the real IP of the first machine or attempting to grab the cookies. Maybe even shellcode to get the AS info and send a note to abuse@.

I sometimes redirect obviously-hostile requests to localhost. E.g. http://localhost/../../../../../etc/passwd

I know it has zero effect, but it's more fun than a 404.

this is neat. I wonder how to combine it with fail2ban / nginx. That said, from a practical perspective, I wonder if "boring" consistent responses might be better, not to encourage attackers to keep trying? (plus false-positive might be costly)

Oohh, that's a nice exercise. A few more ideas that should be easy to implement:

- Content-Type: application/json, and body {"response"꞉ "success"} (hint: that's not an ASCII colon).

- Content-Type: application/json, and body [[[[[...]]]]] nested ten thousand times.

- Redirect to their own public IP, and at a random common port.

- Redirect to their own public IP in dotless hexadecimal notation (ping 172.217.23.110 -> ping 0xacd9176e).

- From[1], redirect to

  http://example.com/;'$(gt=$(perl$IFS-E$IFS's//62/;s/62/chr/e;say');eval$IFS''cowsay$IFS''pwned$IFS$gt/dev/tty)';cowsay$IFS''pwned

(or instead of "cowsay" run "cat" to block their script)

- Pick a header, then insert one from [EICAR test string[2], \x00, \n] somewhere in the middle.

- Or just add a "Server:" header with a random line from the Big List of Naughty Strings[3].

- Redirect to a normal URL, but with a trailing dot in the domain name[4], like "example.com.". It's valid, but you'd be surprised how many things it breaks.

- Nested content encoding with "Content-Encoding: gzip, gzip, gzip, gzip, ...", with a random depth. The n-1 payload is "WAZAAAA".

- "Content-Type: image/jpeg" and "Content‑Encoding: gzip" with a valid gzip body... But the ‑ in "Content‑Encoding" is U+2011 NON-BREAKING HYPHEN.

- "Content-Type: image/jpeg" and "Content-Language: en-US\u000bContent‑Encoding: gzip" with a valid gzip body, where \u000b is a vertical tab.

- Spin the wheel of HTTP status codes! res.WriteHeader(rand.Intn(1000))

- Infinite loop sending a 100 (Continue) every five seconds (they might have a timeout for the TCP and TLS handshakes, and even a timeout for the next TCP segment... But did they remember to set a timeout for receiving the HTTP body?). Watch out for running out of connections.

[1] https://github.com/jwilk/url.sh

[2] https://en.wikipedia.org/wiki/EICAR_test_file

[3] https://github.com/minimaxir/big-list-of-naughty-strings

[4] https://en.wikipedia.org/wiki/Fully_qualified_domain_name

I think I love you mickael-kerjean.

endless rick rolling is always appreciated

Reply on news.ycombinator.com