受到攻击Tomcat服务器

问题描述 投票：0回答：1

更新：感谢杰里。一个黑客的实际管理上载上涨到服务器的根目录访问的可执行文件。黑客针对服务器加入了一下硬币采矿啄。 IT部门并不希望阻止来自某些国家IPS作为我们实际上有一个办事处。所以，我用Google搜索，就如何使TOMCAT更安全。 1.删​​除了所有来与在web应用文件夹的默认安装的应用程序。 2.不要使用Tomcat Web管理器，与之相关的一切都被删除。黑客们试图猜测管理员用户名和密码。有Tomcat的管理应用上是一样滴血液进入海洋充满鲨鱼的。黑客将被吸引到你的服务器。删除Web应用程序的内容之后，我现在服务器返回一个404码。我仍然看到了一些黑客活动，不定期，但几经404层的反应，他们只是停止。

#

我看着我的Tomcat的访问日志，看看下面的条目。貌似有人试图破解我的服务器。这是我们的测试服务器，没有域名，只能通过IP地址访问。我有调试目的启用Tomcat管理网页。

什么是黑客试图实现与所有get和post电话？目前受到攻击或已经被黑客入侵Tomcat服务器？我能做些什么阻止黑客？

198.108.66.176 - - [04/Dec/2018:00:06:28 -0600] "GET / HTTP/1.1" 302 -
198.108.66.176 - - [04/Dec/2018:00:06:28 -0600] "GET / HTTP/1.1" 302 -
196.52.43.116 - - [04/Dec/2018:01:07:31 -0600] "GET / HTTP/1.0" 302 -
92.52.204.77 - - [04/Dec/2018:01:29:58 -0600] "GET / HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:00 -0600] "PROPFIND / HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:00 -0600] "GET /webdav/ HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:04 -0600] "GET /help.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:04 -0600] "GET /java.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:04 -0600] "GET /_query.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:04 -0600] "GET /test.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:05 -0600] "GET /db_cts.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:05 -0600] "GET /db_pma.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:05 -0600] "GET /logon.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:06 -0600] "GET /help-e.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:06 -0600] "GET /license.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:07 -0600] "GET /log.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:07 -0600] "GET /hell.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:07 -0600] "GET /pmd_online.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:08 -0600] "GET /x.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:08 -0600] "GET /shell.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:08 -0600] "GET /htdocs.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:08 -0600] "GET /desktop.ini.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:08 -0600] "GET /z.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:09 -0600] "GET /lala.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:09 -0600] "GET /lala-dpr.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:09 -0600] "GET /wpc.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:09 -0600] "GET /wpo.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:09 -0600] "GET /text.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:10 -0600] "GET /wp-config.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:10 -0600] "GET /muhstik.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:11 -0600] "GET /muhstik2.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:11 -0600] "GET /muhstiks.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:11 -0600] "GET /muhstik-dpr.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:12 -0600] "GET /lol.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:12 -0600] "GET /uploader.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:12 -0600] "GET /cmd.php HTTP/1.1" 302 -

41.223.49.173 - - [04/Dec/2018:02:07:16 -0600] "POST /wuwu11.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:16 -0600] "POST /xw.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:16 -0600] "POST /xw1.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:16 -0600] "POST /9678.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:17 -0600] "POST /wc.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:17 -0600] "POST /xx.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:17 -0600] "POST /s.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:18 -0600] "POST /w.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:19 -0600] "POST /sheep.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:19 -0600] "POST /qaq.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:20 -0600] "POST /db.init.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:20 -0600] "POST /db_session.init.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:20 -0600] "POST /db__.init.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:20 -0600] "POST /wp-admins.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:20 -0600] "POST /m.php?pbid=open HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:21 -0600] "POST /db_dataml.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:21 -0600] "POST /db_desql.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:21 -0600] "POST /mx.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:22 -0600] "POST /wshell.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:23 -0600] "POST /xshell.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:23 -0600] "POST /qq.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:23 -0600] "POST /conflg.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:24 -0600] "POST /lindex.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:24 -0600] "POST /phpstudy.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:24 -0600] "POST /phpStudy.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:24 -0600] "POST /weixiao.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:24 -0600] "POST /feixiang.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:25 -0600] "POST /ak47.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:25 -0600] "POST /ak48.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:25 -0600] "POST /xiao.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:26 -0600] "POST /yao.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:27 -0600] "POST /defect.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:27 -0600] "POST /webslee.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:28 -0600] "POST /q.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:28 -0600] "POST /pe.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:28 -0600] "POST /hm.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:28 -0600] "POST /cainiao.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:28 -0600] "POST /zuoshou.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:29 -0600] "POST /zuo.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:29 -0600] "POST /aotu.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:29 -0600] "POST /cmd.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:29 -0600] "POST /bak.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:30 -0600] "POST /system.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:30 -0600] "POST /l6.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:30 -0600] "POST /l7.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:31 -0600] "POST /l8.php HTTP/1.1" 302 -
41.223.49.173 - - [04/Dec/2018:02:07:31 -0600] "POST /q.php HTTP/1.1" 302 -
security tomcat7
1个回答
0
投票

什么是黑客试图实现与所有get和post电话？

为了找到一个漏洞，他们可能利用;可以知道与已知的bug /孔软件的文件名;现在可能已经出现了从一个可能会怀疑不同的地址similiar请求。

目前受到攻击或已经被黑客入侵Tomcat服务器？

攻击 - 如果在日志中出现了一个状态200则可能破解。以上所有的日志显示302 /重定向;所以可以假设黑客并没有收获。

我能做些什么阻止黑客？

请在IP地址的whois;阻断报道的范围 - 赔率是它是你不还是想做生意的国家。 ;）最好的，如果流量可以在网络分界点（网关/路由器）被丢弃（或阻止）。阿帕奇也可以配置，以及 - 请看下图：

Blocking multiple ip ranges using mod access in htaccess

最新问题
© www.soinside.com 2019 - 2024. All rights reserved.