Sponsored Content
Special Forums Cybersecurity [Linux] Blocking Your w00tw00ts with iptables Post 302376757 by Neo on Wednesday 2nd of December 2009 07:53:51 AM
Old 12-02-2009
To Followup.......

When you are searching your logfiles for w00tw00ts, be careful not to mistakenly identify legitimate requests from friendly hosts, for example, requests for posts with w00tw00t in the URL who might be reading a post you have on the topic Smilie

I updated my example to reflect this:

Code:
grep "GET /w00tw00t.at.ISC.SANS.DFind:)" /website/logs/apache2/access.log

 

10 More Discussions You Might Find Interesting

1. UNIX for Advanced & Expert Users

LINUX 9 IPTABLES and DNS

I have installed a linux 9 router/firewall and have issues with outside DNS queries making it in. here are my IPTABLE rules, can anyone make some suggestions? ETH1 is my outside facing Interface, ETH0 is my inside facing interface. Accept If input interface is not eth1 Accept If protocol is... (1 Reply)
Discussion started by: frankkahle
1 Replies

2. Linux

LINUX 9 IPTABLES and DNS

I have installed a linux 9 router/firewall and have issues with outside DNS queries making it in. here are my IPTABLE rules, can anyone make some suggestions? ETH1 is my outside facing Interface, ETH0 is my inside facing interface. Accept If input interface is not eth1 Accept If protocol... (6 Replies)
Discussion started by: frankkahle
6 Replies

3. UNIX for Dummies Questions & Answers

Linux IPTABLES help

I'm new to Linux and I made a big mistake at work recently locking myself out of our own server :(. I did iptables -F first as the tutorial said and then entered the rules. I wanted to start over again so I did iptables -F and it locked us out. We had to get someone to physically restart... (0 Replies)
Discussion started by: nogumo
0 Replies

4. Programming

Linux BSD sockets blocking issue

I am using BSD TCP sockets under Debian Linux 2.6 and no matter what I do, the socket blocks on recv. I have set O_NONBLOCK and O_NDELAY using fcntl to no effect. Any ideas ? (3 Replies)
Discussion started by: johnmb
3 Replies

5. Shell Programming and Scripting

Non-blocking pipe

Hello, Would this be an acceptable way of creating a non-blocking pipe. Basically I want to create kind of a server client arch. This code would be in the server, and I don't want to have to wait for clients to read before moving on to the next client. One problem I can see is if... (4 Replies)
Discussion started by: cdlaforc
4 Replies

6. Debian

URL blocking with iptables

we have internal network 192.168.129.x for a system hosted with pdf.xxx.xyz URL is already public accessible but when try to connect as site (/ap/p.nt) of the URL pdf.xxx.xyz/ap/p.nt restriction to be applied publicly except accessing internally can anyone guide me on this?? (1 Reply)
Discussion started by: shrinuvas
1 Replies

7. UNIX for Advanced & Expert Users

ps blocking

Hi Folks I have been debugging a script that is called every thirty seconds. Basically it is doing a ps, well two actually, one to file (read by the getline below) and the other into a pipe. The one into the pipe is: - V_SYSVPS=/usr/sysv/bin/ps $V_SYSVPS -p$PIDLIST -o$PSARGS... (0 Replies)
Discussion started by: steadyonabix
0 Replies

8. UNIX for Dummies Questions & Answers

Linux iptables -> is it possible?

Hi! I have a dedicated hosting working with 2 ips. Is it possible to block all connections but 1 in all existing ports for only 1 of my ips? I mean like, I have 2 ips for example: 190.x.x.5 and 190.x.x.6 I want that all the connections going to 190.x.x.6 in all ports get rejected but only 1... (7 Replies)
Discussion started by: Kekox
7 Replies

9. Programming

Which are blocking and non-blocking api's in sockets in C ?

among the below socket programming api's, please let me know which are blocking and non-blocking. socket accept bind listen write read close (2 Replies)
Discussion started by: VSSajjan
2 Replies

10. Cybersecurity

Blocking 3306 with iptables -A INPUT -p tcp --dport 3306

Just added these lines to our server firewall: iptables -A INPUT -p tcp --dport 3306 -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT iptables -A INPUT -p tcp --dport 3306 -j DROP Even though mysql is configured to correctly only listen on port 127.0.0.1 we still see these mysql log file notes on a daily... (0 Replies)
Discussion started by: Neo
0 Replies
ZGREP(1)						      General Commands Manual							  ZGREP(1)

NAME
zgrep - search possibly compressed files for a regular expression SYNOPSIS
zgrep [ grep_options ] [ -e ] pattern filename... DESCRIPTION
Zgrep invokes grep on compressed or gzipped files. These grep options will cause zgrep to terminate with an error code: (-[drRzZ]|--di*|--exc*|--inc*|--rec*|--nu*). All other options specified are passed directly to grep. If no file is specified, then the standard input is decompressed if necessary and fed to grep. Otherwise the given files are uncompressed if necessary and fed to grep. If the GREP environment variable is set, zgrep uses it as the grep program to be invoked. EXIT CODE
2 - An option that is not supported was specified. AUTHOR
Charles Levert (charles@comm.polymtl.ca) SEE ALSO
grep(1), gzexe(1), gzip(1), zdiff(1), zforce(1), zmore(1), znew(1) ZGREP(1)
All times are GMT -4. The time now is 08:58 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy