时间爱人

偶遇孤儿【记一次恶意解析301处理】

本来已经绝对两个月之内不搞我自己网站了,子站像卢航大学卢航软件服务卢航论坛等等吧都已经闭站恢复原始数据了。然而今日发现孤儿上门认爹,发发牢骚。

在文章开始之前,我觉得有必要解释一下什么叫孤儿。

孤儿=指失去父母的儿童或者是未成年人;查找不到生父母的弃婴和儿童,现代话说的就是“si ma le”

话不多说,上图吧。

没错,孤儿,说的就是你,多学点东西再来吧。

QQ截图20180606114327.png

这个在我网站下方有三个孤儿站。

至于这样的孤儿站有什么用,凭什么要这么做,先不谈了。

那这些是怎么操作的呢?

直接IP解析到我上面,至于用的什么站群工具,看不出来。可能是孤儿又找的其他孤儿去做的吧。

如果用SEO工具可以看到和我网站的TDK是一模一样,只是关键词的排名不一样。

如果用源代码查看工具可以看到和我的网站内容也是一模一样。

检索量少的你能做?

那多的呢孤儿?

给你报一下我服务器配置吧。多给你点机会,不是想学shell么?学了能干啥?啊?你进不去我ssh面板,你写***shell呢?

IP就不用说了,香港的新视界机房。

操作系统:Linux-centos6.4【没错,低版本学习资料多,漏洞也多,就方便给你搞】

环境:lnmp [ linux Apache-NGINX1.14-Tengine2.2 MySQL5.5 PHP5.63 ] 

只有一个Symantec的SSL证书【¥1700/年】孤儿你买得起么,没有开启cookie过滤,没有开启post过滤,禁用了php、jsp、zip、py的文件上传,nginx防盗链,也没有写防CC的shell,目前的安全措施除了账号密码,就没别的防御了。

【端口默认,安全组没有,默认用户名,密码大小写字母加几个数字,没字符,赶紧去试试吧。】

什么cookie/sql注入,cc/ddos,xss,都能随便搞我网站,就是你水平不行啊孤儿。

就是过来恶心我的呢?233

QQ截图20180606145612.png

那我是怎么解决的呢?

你这次只是解析的IP,我就把lnmp的default站点指向了guer.shijianairen.com,而且返回的状态码是444,一下就解决了,孤儿,请继续表演吧。

不知道你用了多久,反正我一分钟就处理掉了。

希望你下次还想这样干的话,你就用CNAME指向www.shijianairen.com,看看我还有办法没了。

其他的配置信息,供孤儿参考和研究。求你了,搞掉我?

给你点机密信息吧:部分有编译过,都是XML格式。

网站配置文件【非常重要,好好看看】:

server
{
    listen 80;
    listen 443 ssl;
    server_name www.shijianairen.com shijianairen.com;
    
    index index.php index.html index.htm default.php default.htm default.html;
    root /www/wwwroot/www.shijianairen.com;
    
    #SSL-START SSL
    #error_page 404/404.html;
    limit_conn perserver 300;
    limit_conn perip 25;
    limit_rate 512k;
	#301-START
		if ($host ~ '^shijianairen.com'){
			return 301 http://www.shijianairen.com$request_uri;
		}
	#301-END
    #HTTP_TO_HTTPS_START
    if ($server_port !~ 443){
        rewrite ^(/.*)$ https://$host$1 permanent;
    }
    #HTTP_TO_HTTPS_END
    ssl_certificate    /etc/letsencrypt/live/www.shijianairen.com/fullchain.pem;
    ssl_certificate_key    /etc/letsencrypt/live/www.shijianairen.com/privkey.pem;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    error_page 497  https://$host$request_uri;

    #SSL-END
    
    #ERROR-PAGE-START  错误页
    error_page 404 /404.html;
    error_page 502 /502.html;
    #ERROR-PAGE-END
    
    #PHP-INFO-START  
    #SECURITY-START 防盗链
    location ~ .*\.(jpg|jpeg|gif|png|js|css)$
    {
        expires      30d;
        access_log off;
        valid_referers none blocked www.shijianairen.com shijianairen.com;
        if ($invalid_referer){
           return 404;
        }
    }
    #SECURITY-END
    include enable-php-56.conf;
    #PHP-INFO-END
    
    #REWRITE-START URL重写
    include /www/server/panel/vhost/rewrite/www.shijianairen.com.conf;
    #REWRITE-END
    
    #禁访目录
    location ~ ^/(\.user.ini|\.htaccess|\.git|\.svn|\.project|LICENSE|README.md)
    {
        return 404;
    }
    
    #SSL证书
    location ~ \.well-known{
        allow all;
    }
    
    location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
    {
        expires      30d;
        access_log off; 
    }
    
    location ~ .*\.(js|css)?$
    {
        expires      12h;
        access_log off; 
    }
    access_log  /www/wwwlogs/www.shijianairen.com.log;
    error_log  /www/wwwlogs/www.shijianairen.com.error.log;
}

NGINX:

user  www www;
worker_processes auto;
error_log  /www/wwwlogs/nginx_error.log  crit;
pid        /www/server/nginx/logs/nginx.pid;
worker_rlimit_nofile 51200;

events
    {
        use epoll;
        worker_connections 51200;
        multi_accept on;
    }

http
    {
        include       mime.types;
		include luawaf.conf;

		include proxy.conf;

        default_type  application/octet-stream;

        server_names_hash_bucket_size 512;
        client_header_buffer_size 32k;
        large_client_header_buffers 4 32k;
        client_max_body_size 50m;

        sendfile   on;
        tcp_nopush on;

        keepalive_timeout 60;

        tcp_nodelay on;

        fastcgi_connect_timeout 300;
        fastcgi_send_timeout 300;
        fastcgi_read_timeout 300;
        fastcgi_buffer_size 64k;
        fastcgi_buffers 4 64k;
        fastcgi_busy_buffers_size 128k;
        fastcgi_temp_file_write_size 256k;
		fastcgi_intercept_errors on;

        gzip on;
        gzip_min_length  1k;
        gzip_buffers     4 16k;
        gzip_http_version 1.1;
        gzip_comp_level 2;
        gzip_types     text/plain application/javascript application/x-javascript text/javascript text/css application/xml;
        gzip_vary on;
        gzip_proxied   expired no-cache no-store private auth;
        gzip_disable   "MSIE [1-6]\.";

        limit_conn_zone $binary_remote_addr zone=perip:10m;
		limit_conn_zone $server_name zone=perserver:10m;

        server_tokens off;
        access_log off;

server
    {
        listen 888;
        server_name shijianairenpma;
        index index.html index.htm index.php;
        root  /www/server/phpmyadmin;

        #error_page   404   /404.html;
        include enable-php.conf;

        location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
        {
            expires      30d;
        }

        location ~ .*\.(js|css)?$
        {
            expires      12h;
        }

        location ~ /\.
        {
            deny all;
        }

        access_log  /www/wwwlogs/access.log;
    }
include /www/server/panel/vhost/nginx/*.conf;
}

PHP5.6.3【装过redis,ZendGuardLoader、recode、pspell、gmp、wddx这些扩展;禁用了ini_alter、chown、popen、passthru函数。了解一下。】:  代码太多了,复制下来占我数据库容量。都默认的没改过,不会了自己搭建试一试就行了。

孤儿,好好看看吧、

16 thoughts on “偶遇孤儿【记一次恶意解析301处理】

  1. Hi there, I do think your website may be having internet browser compatibility issues.
    Whenever I look at your blog in Safari, it looks fine however when opening in I.E., it’s got some overlapping
    issues. I just wanted to provide you with a quick heads up!
    Besides that, excellent site!

  2. We stumbled over here coming from a different page and thought I may
    as well check things out. I like what I see so now i am following
    you. Look forward to finding out about your web page again. plenty
    of fish natalielise

  3. Excellent pieces. Keep posting such kind of information on your blog.
    Im really impressed by your site.
    Hey there, You’ve performed an incredible job. I’ll definitely digg it
    and in my view recommend to my friends. I’m confident they will be benefited from this website.

  4. Its like you read my mind! You appear to understand so much about this, like you
    wrote the ebook in it or something. I believe that you just
    can do with some percent to pressure the message home a little
    bit, but instead of that, that is wonderful blog.
    A fantastic read. I will definitely be back.

  5. Howdy great website! Does running a blog such as this take a massive amount
    work? I’ve absolutely no knowledge of computer programming however I had been hoping to start my own blog soon. Anyhow,
    if you have any recommendations or techniques for new blog owners
    please share. I understand this is off subject
    but I just wanted to ask. Many thanks!

发表评论

电子邮件地址不会被公开。 必填项已用*标注

答案 : *
20 + 16 =


返回顶部