Blocking w00tw00t.at.ISC.SANS.DFind:)
Here’s a little how-to for dealing with “w00tw00t” scans on webservers. Laws Hosting already implements this procedure, but its nice to know.
You might see these scans in your logs as:
.. "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 ...
Using Iptables
The quickest method of making sure it never reaches your webserver (and thus wasting resources like processor, disk space [log files], etc) is to use iptables, and it can be done with a one-liner like this:
iptables -I INPUT -d xxx.xxx.xxx.xxx -p tcp –dport 80 -m string –to 70 –algo bm –string ‘GET /w00tw00t.at.ISC.SANS.’ -j DROP
Simply replace xxx.xxx.xxx.xxx with the IP of your web server. If you want to use this for a range of IPs (ie., you’re using failover IPs to host web servers), simply replace the “-d xxx.xxx.xxx.xxx” portion with:
-m iprange –dst-range start.xxx.xxx.xxx-end.xxx.xxx.xxx
where start.xxx.xxx.xxx and end.xxx.xxx.xxx are the first and last IPs of your web servers respectively.
If you wish to have a fancier option, one where it will for example blacklist an IP for a certain period, etc., have a look at SpamCle@ner’s website.
They go deeper into this subject and have provided two scripts near the end of their article. Simply save one of these scripts in a file named, for example, /opt/blockw00t.sh and make it executable with:
chmod +x /opt/blockw00t.sh
You can run it manually with typing “/opt/blockwoot.sh” in the shell or to automatically load it at boot time you can add it to your /etc/rc.localfile, or on Debian/Ubuntu systems add it to your /etc/network/interfaces like so:
auto eth0 inet eth0 static [existing configuration that remains unaltered] # Load anti-w00t script: post-up /opt/blockw00t.sh
