HTTP Vulnerability Scan Protection

• HTTP Protection Overview
• How to enable HTTP protection
• Detection Rules
• Advanced Settings

Protection Overview

RdpGuard protects your HTTP server from vulnerability scan attempts. It monitors web server logs to find requests that may indicate vulnerability scan attempts and temporarily blocks source IP addresses if the number of requests reaches a set limit.

HTTP protection is based on the detection engine that uses a set of detection rules to determine if a request is a scan attempt.

To enable and configure HTTP protection

1. Start RdpGuard Dashboard and click the link next to HTTP

HTTP Protection Link in RdpGuard Dashboard

The HTTP Protection Settings dialog will open:

HTTP Detection Engine Settings

IIS log directores

You can specify one or multiple IIS log directories for monitoring. IIS logs are usually located in C:\inetpub\logs\LogFiles

Select IIS log directories for monitoring

Detection Rules

Detection rules are set of key-value pairs with wildcards support. Each rule must start from the new line.

For example:

key[equality-operator]value,key[equality-operator]value
key[equality-operator]value,key[equality-operator]value
			

Supported equality operators are: = (equals) and != (not equals)

For example:

key1=value1, key2!=value2
key3=value3, key2=value4
key4=*value5
			

If log line details match any of the rules, the log line considered as scan attempt and source IP address is reported to RdpGuard Core, i.e. the Logical OR applies to the rules

Rule may contain any number of conditions separated by comma, the line matches the rule if all conditions are match, i.e. the Logical AND applies to rule conditions.

So, the example above will be interpreted as - treat log line as scan attempt if (key1 equals value1 and key2 not equals value2) OR (key3 equals value3 and key2 equals value4) OR (key4 ends with value5)

Supported keys are:

• Method
• Uri
• Query
• UserName
• UserAgent
• Referer
• Status

Threshold

You can also apply the Threshold condition to the rule. This optional condition can be useful if you do not want to treat each rule match as scan attempt.

For example rule based on the HTTP Status code - this rule can be used to detect most of the scan attempts, because all they usually result to log entries with HTTP 404 status code.

But it might be not wise to threat each 404 hit as scan attempt (regular visitors may just misprint the page address or follow the obsolete link, if they do this 3 times they will be blocked, this is probably not what you want.

But repeating 404 requests may indicate vulnerability scan, so we may configure the engine to threat each ten 404 requests as one scan attempt and this is what the Threshold variable for.

For this reason we may omit the Threshold condition for Uri based rules, for example if someone is trying to open the /wp-login.php page (and we know that our website is not Wordpress based, so there is no such a page) this is most likely the scan attempt, so HTTP engine should report it immediately to RdpGuard Core.

Sample Rules

You can use the following example as a reference:

Status=404,Threshold=15

Uri=*/.aws*
Uri=*/.env*
Uri=*/.git*
Uri=*/.hg/*
Uri=*/.svn*
Uri=*/.vscode*

Uri=/*.bz2
Uri=/*.tar.gz
Uri=/*.tgz
Uri=/*.7z
Uri=/*.zip, Uri!=/download/*
Uri=/*.rar

Uri=*/wp-content/*
Uri=*/wp-admin/*
Uri=*/wp-includes/*
Uri=*/wp-json/*
Uri=*/wp-config*
Uri=*/wp-login.php*

Uri=*/admin*
Uri=*/cgi-bin*
Uri=*/phpmyadmin*
Uri=*/webadmin*
Uri=*/wordpress*
Uri=*/plus/*
Uri=*/passwd*
Uri=*/uploads/*
Uri=*/phpunit/*

Uri=*webshell*

Uri=*login.php*
Uri=/info.php
Uri=/user.php
Uri=/type.php
Uri=*guestbook.php*
Uri=*xmlrpc.php*
Uri=*ofc_upload_image.php*

Uri=*ajax.js*
Uri=*login.action*

Advanced Settings

Clicking the "advanced settings" link will open the Advanced HTTP Settings dialog where you can configure additional HTTP protection settings.

Advanced HTTP Detection Engine Settings

Use the X-Forwarded-For field to read client IP address

By default, RdpGuard reads the client IP address from the Client IP field in the IIS log. If your web server is behind a proxy server, you may need to enable this option to read the client IP address from the X-Forwarded-For field.

This option should only be enabled if you are hosting the website behind a proxy.

Note: Proper configuration of your proxy server and IIS logging is required for this feature to work correctly.

Please refer to the Configuring IIS to Detect Source IP Behind a Proxy guide for detailed instructions.

Blocking Requests When Using X-Forwarded-For

When using the X-Forwarded-For option, the default blocking mechanism may not work as expected because banning the real client IP must be done on the proxy level. Without additional configuration, the blocking will not actually occur.

To ensure requests from detected malicious IPs are blocked, you can use IIS IP Restrictions combined with Custom Actions in RdpGuard.

Configuring Custom Actions in RdpGuard

Follow these steps to configure IIS to block IPs based on RdpGuard detections:

• Ensure that the IP and Domain Restrictions feature is installed in IIS.
• Enable IIS IP Restrictions to prevent requests from blocked IPs.
• Use Custom Actions in RdpGuard to dynamically update the IIS IP block list when a new malicious IP is detected.

Configure the following actions in RdpGuard:

IP Blocked Action

• Task: Execute program
• Path: c:\Windows\system32\inetsrv\appcmd.exe
• Arguments:
  

  set config /section:system.webServer/security/ipSecurity /+"[ipAddress='%IP%',allowed='false']"

IP Unblocked Action

• Task: Execute program
• Path: c:\Windows\system32\inetsrv\appcmd.exe
• Arguments:
  

  set config /section:system.webServer/security/ipSecurity /-"[ipAddress='%IP%']"

With this setup, detected malicious IPs will be automatically added to the IIS IP restrictions list, effectively blocking their requests.

RdpGuard protects:

• Remote Desktop
• MS-SQL Server
• FTP Protocol
• HTTP Protocol
• IMAP Protocol
• POP3 Protocol
• SMTP Protocol
• IIS Web Login
• MySQL Server
• ASP.NET Forms
• RD Web Access
• VoIP (SIP Protocol)
• SSH Protocol
• MS VPN (RRAS)

RdpGuard

 

People like RdpGuard!