Fail2Ban.WebExploits

Fail2Ban.WebExploits copied to clipboard

spithash

Look at return code in addition to request path

2

Currently, the strategy to handle false positives seems to be to "make sure you stop using such plugins or themes and rename any folders or files to something more suitable"....

yitzhaq

WordPress backend navigation blocked.

2

While I'm navigating on WordPress backend I'm getting banned. Specially while updating the WordPress plugins through "Dashboard>Update". Anyway to correct it?

Chathu07

since the Fail2Ban.WebExploits has not been updated in a long time #I have updated in a pull request as seen here https://github.com/bigalownz/Fail2Ban.WebExploits

bigalownz

Optimize regexes to significantly increase processing speed

1

It is better to join all regexes into one large regex to significantly increase processing speed. How to do it: https://github.com/fail2ban/fail2ban/issues/2762 It increases processing speed from 200 log lines per...

woodholly

/js/tools.js should not match for woorewards

1

woorewards is a common plugin and is matching with "/wp-content/plugins/woorewards/assets/lws-adminpanel/js/tools.js?ver=3.9.9" a patch is coming

zxfrank

Other free sources [from suricata](https://github.com/OISF/suricata-update/blob/master/suricata/update/data/index.py) IDS: - oisf/trafficid https://openinfosecfoundation.org/rules/trafficid/trafficid.rules - sslbl/ja3-fingerprints https://sslbl.abuse.ch/blacklist/ja3_fingerprints.rules - et/open https://rules.emergingthreats.net/open/suricata-%(__version__)s/emerging.rules.tar.gz - ptresearch/attackdetection https://raw.githubusercontent.com/ptresearch/AttackDetection/master/pt.rules.tar.gz - sslbl/ssl-fp-blacklist https://sslbl.abuse.ch/blacklist/sslblacklist.rules - tgreen/hunting https://raw.githubusercontent.com/travisbgreen/hunting-rules/master/hunting.rules - etnetera/aggressive https://security.etnetera.cz/feeds/etn_aggressive.rules - https://github.com/seanlinmt/suricata/tree/master/files/rules -...

drzraf

Contributing Scan Signatures

2

Anyone who wishes to contribute any scan signatures found in their web server logs, please send a Pull Request on the [exploits.list file](https://github.com/mitchellkrogza/Fail2Ban.WebExploits/blob/master/input-source/exploits.list)

mitchellkrogza

Custom Log Format

1

Hi, how can I adjust the regex to match our custom log file format from nginx? This is our logfile format (because we have multiple sites running on one instance):...

crebuh

Hi, In my nginx reverse proxy server I have around 15 web sites and those have been configured to send a logs to different directory under /var/log/nginx - e.g site1...

Blason