1. Apache Web Server Mitigation for xmlrpc.php
Apache Web server can be mitigated from Brute Force attack using simple directive for xmlrpc.php and wp-trackback.php
<FilesMatch “^(xmlrpc\.php|wp-trackback\.php)”>
Order Deny,Allow
Deny from all
Allow from *.wordpress.com
Allow from 192.0.64.0/18
Allow from 185.64.140.0/22
Allow from 2a04:fa80::/29
Allow from 76.74.255.84
Allow from 76.74.255.85
Allow from 192.0.65.204
Allow from 192.0.65.205
Allow from 192.0.80.244
Allow from 192.0.80.246
Allow from 192.0.96.247
Allow from 192.0.96.248
Allow from 192.0.123.250
Satisfy All
ErrorDocument 403 http://127.0.0.1/
</FilesMatch>
2. xmlrpc.php Mitigation with Mod_Security
<Locationmatch “/xmlrpc.php”> SecRule REQUEST_METHOD “POST” “deny,status:401,id:48658231,chain,msg:’xmlrpc request blocked, no referrer’” SecRule &HTTP_REFERER “@eq 0”
</Locationmatch>
3. Mitigation for Bad Bots using Mod_Security
Create a file badbotlist.txt under /etc/apache2/conf.d/modsec/ or on your computer and upload to /etc/apache2/conf.d/modsec/
add the Bot List File badbotlist.txt
Once you have the file add this to your modsec/modsec2.user.conf (You can do this via ConfigServer ModSecurity Control
SecRule REQUEST_HEADERS:User-Agent “@pmFromFile badbotlist.txt” “id:350001,rev:1,severity:2,log,msg:’BAD BOT — Detected and Blocked. ‘”
Restart Your Apache Web Server
- WordPress Attack Mitigation
- Reconnaissance
- Wireless Attacks
- Vulnerable Scanning
- Social engineering
- Reverse Engineering
- Exploitation
- Post Exploitation
- Web App Pen Testing
- Reporting & Documetation
Services
- Secure Private Cloud
- Programming
- Secure Websites
- Linux Security
- Windows Security