# How can I block the attack like this? **URL:** \ **Category:** NGINX\ **Created:** [September 4, 2012, 3:42pm UTC](https://www.ruby-forum.com/t/how-can-i-block-the-attack-like-this/222642 "2012-09-04T15:42:33Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![aris](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/258eb7/32.png) [@aris](https://www.ruby-forum.com/u/aris)\ **Post date:** [September 4, 2012, 3:42pm UTC](https://www.ruby-forum.com/t/how-can-i-block-the-attack-like-this/222642/1 "2012-09-04T15:42:33Z")
Hi all, Today my server was attacked. After checked Nginx access log, I found logs like below: 116.114.17.182 - - [04/Sep/2012:20:27:41 +0800] “GET /member.php??username=xxxx&rndnum=-1777927191 HTTP/1.1” 500 186 “-” “-” “-” 116.114.17.182 - - [04/Sep/2012:20:27:41 +0800] “GET /member.php??username=xxxx&rndnum=-1777927191 HTTP/1.1” 500 186 “-” “-” “-” 116.114.17.182 - - [04/Sep/2012:20:27:41 +0800] “GET /member.php??username=xxxx&rndnum=-1777927191 HTTP/1.1” 500 186 “-” “-” “-” It seems the attacker was using some tool to attack my server. You can see that the user agent / browser version are blank. Due to I can’t block the blank user agent (some web browser is using blank user agent, for example, UC), is there any way can I use to block this kind of attack? Thank ---
**Author:** ![fhal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/ccd318/32.png) [@fhal](https://www.ruby-forum.com/u/fhal)\ **Post date:** [September 4, 2012, 3:46pm UTC](https://www.ruby-forum.com/t/how-can-i-block-the-attack-like-this/222642/2 "2012-09-04T15:46:39Z")
Hi, WAF([Google Code Archive - Long-term storage for Google Code Project Hosting.](http://code.google.com/p/naxsi/)) at possible solution? Regards, ---
**Author:** ![fhal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/ccd318/32.png) [@fhal](https://www.ruby-forum.com/u/fhal)\ **Post date:** [September 4, 2012, 3:50pm UTC](https://www.ruby-forum.com/t/how-can-i-block-the-attack-like-this/222642/3 "2012-09-04T15:50:09Z")
Hi, If the user is coming from the same ip address you can block it in your iptables or firewall. Regards ---
**Author:** ![fhal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/ccd318/32.png) [@fhal](https://www.ruby-forum.com/u/fhal)\ **Post date:** [September 4, 2012, 4:15pm UTC](https://www.ruby-forum.com/t/how-can-i-block-the-attack-like-this/222642/4 "2012-09-04T16:15:19Z")
what I see is that you want to block XSS attacks and code injection, that is why I recommend a WAF Regards, On Tue, Sep 4, 2012 at 10:49 AM, Jaap van Arragon ---
**Author:** ![fhal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/ccd318/32.png) [@fhal](https://www.ruby-forum.com/u/fhal)\ **Post date:** [September 5, 2012, 2:49am UTC](https://www.ruby-forum.com/t/how-can-i-block-the-attack-like-this/222642/5 "2012-09-05T02:49:27Z")
Thanks . But it seems WAF can only support nginx which version is lower than 1.2.0. At 2012-09-04 22:14:57,“removed\_email\_address@domain.invalid” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: what I see is that you want to block XSS attacks and code injection, that is why I recommend a WAF Regards, On Tue, Sep 4, 2012 at 10:49 AM, Jaap van Arragon [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: Hi, If the user is coming from the same ip address you can block it in your iptables or firewall. Regards On 9/4/12 3:45 PM, “removed\_email\_address@domain.invalid” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: Hi, WAF([Google Code Archive - Long-term storage for Google Code Project Hosting.](http://code.google.com/p/naxsi/)) at possible solution? Regards, On Tue, Sep 4, 2012 at 10:42 AM, fhal [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: Hi all, Today my server was attacked. After checked Nginx access log, I found logs like below: 116.114.17.182 - - [04/Sep/2012:20:27:41 +0800] “GET /member.php??username=xxxx&rndnum=-1777927191 HTTP/1.1” 500 186 “-” “-” “-” 116.114.17.182 - - [04/Sep/2012:20:27:41 +0800] “GET /member.php??username=xxxx&rndnum=-1777927191 HTTP/1.1” 500 186 “-” “-” “-” 116.114.17.182 - - [04/Sep/2012:20:27:41 +0800] “GET /member.php??username=xxxx&rndnum=-1777927191 HTTP/1.1” 500 186 “-” “-” “-” It seems the attacker was using some tool to attack my server. You can see that the user agent / browser version are blank. Due to I can’t block the blank user agent (some web browser is using blank user agent, for example, UC), is there any way can I use to block this kind of attack? Thank * * * nginx mailing list removed\_email\_address@domain.invalid [http://mailman.nginx.org/mailman/listinfo/nginx](http://mailman.nginx.org/mailman/listinfo/nginx) * * * nginx mailing list removed\_email\_address@domain.invalid [http://mailman.nginx.org/mailman/listinfo/nginx](http://mailman.nginx.org/mailman/listinfo/nginx) – Victor Pereira ---
**Author:** ![fhal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/ccd318/32.png) [@fhal](https://www.ruby-forum.com/u/fhal)\ **Post date:** [September 5, 2012, 3:53am UTC](https://www.ruby-forum.com/t/how-can-i-block-the-attack-like-this/222642/6 "2012-09-05T03:53:09Z")
Try the limit\_conn moule: [Module ngx\_http\_limit\_conn\_module](http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html). Or the limit\_req module: [Module ngx\_http\_limit\_req\_module](http://nginx.org/en/docs/http/ngx_http_limit_req_module.html). 2012/9/5 removed\_email\_address@domain.invalid [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid): ---
**Author:** ![fhal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/ccd318/32.png) [@fhal](https://www.ruby-forum.com/u/fhal)\ **Post date:** [September 5, 2012, 3:48am UTC](https://www.ruby-forum.com/t/how-can-i-block-the-attack-like-this/222642/7 "2012-09-05T03:48:28Z")
I see that the documentation says it works only with older versions of nginx and according to what I see in the installation manual can be compiled with any version of nginx