GET /index.php – Access to a script modified/created less than 10 hour(s) ago
-
Hi,
I got alert email and also can see on the log file, such events:
17/Feb/21 10:33:10 #2465301 INFO – 34.255.198.166 GET /index.php – Access to a script modified/created less than 10 hour(s) ago – [/var/www/vhosts/example.com/staging.example.com/index.php] – staging.example.com
My index.php file content is:
<?php/**
* Front to the WordPress application. This file doesn’t do anything, but loads
* wp-blog-header.php which does and tells WordPress to load the theme.
*
* @package WordPress
*//**
* Tells WordPress to load the WordPress theme and output it.
*
* @var bool
*/
define( ‘WP_USE_THEMES’, true );/** Loads the WordPress Environment and Template */
require __DIR__ . ‘/wp-blog-header.php’;May I ask:
1. What is special/risky in the event reported by you?
2. Was any attack blocked?
3. Could it be a false report generated as a result of a backup restore process, making the index.php file “new” with a new date?
4. Should the index.php content be modified?
5. Should the index.php file be somehow white-listed?
6. Should I take any other protection measurements?
7. I saw on testing I can NOT use the trick of:
if (!defined(‘ABSPATH’)) exit;
Can it be otherwise defined to block direct access to this index.php file which is not part of legtimate request for this file as part as legitimate request to GET access to the website itself?
-
.htninja file content (file is placed one folder “above” root folder):
<?php
/*
+=====================================================================+
| NinjaFirewall optional configuration file |
| |
| See: https://nintechnet.com/ninjafirewall/wp-edition/help/?htninja |
| |
+=====================================================================+
*/// =======================================================
// Single IPv4 and IPv6:
$ip_array = array( ‘IP LIST’ );
if ( in_array( $_SERVER[“REMOTE_ADDR”], $ip_array ) ) {
// white list it:
return ‘ALLOW’;
}// =======================================================
// CIDR (IPv4 **only**):
$cidr_array = array( ‘CIDE LIST’ );
// Loop through the array:
foreach ( $cidr_array as $cidr ) {
// Check IP vs CIDR:
if ( ipCIDRCheck( $_SERVER[‘REMOTE_ADDR’], $cidr ) ) {
// IP matches, white list it:
return ‘ALLOW’;
}
}
function ipCIDRCheck( $IP, $CIDR ) {
list ( $subnet, $bits ) = explode( ‘/’, $CIDR );
$ip = ip2long( $IP );
$subnet = ip2long( $subnet );
$mask = -1 << ( 32 – $bits );
$subnet &= $mask;
return ( $ip & $mask ) == $subnet;
}
// =======================================================// To tell NinjaFirewall where you moved your WP config file,
// use the ‘$wp_config’ variable :
// ** NOTE: Deprecated since NinjaFirewall 3.0.1 **
// $wp_config = ‘/foo/bar/wp-config.php’;// Users of Cloudflare CDN:
// if (! empty($_SERVER[“HTTP_CF_CONNECTING_IP”]) &&
// filter_var($_SERVER[“HTTP_CF_CONNECTING_IP”], FILTER_VALIDATE_IP) ) {
// $_SERVER[“REMOTE_ADDR”] = $_SERVER[“HTTP_CF_CONNECTING_IP”];
// }// Users of Incapsula CDN:
// if (! empty($_SERVER[“HTTP_INCAP_CLIENT_IP”]) &&
// filter_var($_SERVER[“HTTP_INCAP_CLIENT_IP”], FILTER_VALIDATE_IP) ) {
// $_SERVER[“REMOTE_ADDR”] = $_SERVER[“HTTP_INCAP_CLIENT_IP”];
// }// Whitelist/blacklist whatever you want:
//
// Return codes:
// ‘ALLOW’ == Allow and stop filtering (whitelist).
// ‘BLOCK’ == Reject immediately (blacklist).
//
// Any other return code will be ignored
//
// Note that if you use ‘ALLOW’/’BLOCK’, nothing will be written
// to the firewall log.// Whitelist single IP 1.2.3.4:
// if ( $_SERVER[“REMOTE_ADDR”] == ‘1.2.3.4’ ) {
// return ‘ALLOW’; // whitelist
// }// Whitelist SINGLE IPs 1.1.1.1, 2.2.2.2 and 3.3.3.3:
//$ip_array = array( Seperate IP LIST AGAIN );
//if ( in_array( $_SERVER[“REMOTE_ADDR”], $ip_array ) ) {
// return ‘ALLOW’; // whitelist
// }// Whitelist all IPs from 1.1.1.1 to 1.1.1.255:
// if ( preg_match( ‘/^1\.1\.1\.\d+$/’, $_SERVER[“REMOTE_ADDR”] ) ) {
// return ‘ALLOW’; // whitelist
// }// Blacklist single IP 1.2.3.4:
// if ( $_SERVER[“REMOTE_ADDR”] == ‘1.2.3.4’ ) {
// return ‘BLOCK’; // blacklist
// }// Blacklist IPs 1.1.1.1, 2.2.2.2 and 3.3.3.3:
// $ip_array = array( ‘1.1.1.1’ , ‘2.2.2.2’ , ‘3.3.3.3’ );
// if ( in_array( $_SERVER[“REMOTE_ADDR”], $ip_array ) ) {
// return ‘BLOCK’; // blacklist
// }// Blacklist all IPs from 1.1.1.1 to 1.1.1.255:
// if ( preg_match( ‘/^1\.1\.1\.\d+$/’, $_SERVER[“REMOTE_ADDR”] ) ) {
// return ‘BLOCK’; // blacklist
// }// Do not filter any HTTP request sent to a script located inside the /myfolder/ directory:
// if (strpos($_SERVER[‘SCRIPT_FILENAME’], ‘/myfolder/’) !== FALSE) {
// return ‘ALLOW’;
// }// Advanced filtering :
// Block immediately a POST request if it contains a ‘whatever’ variable
// sent to a script named ‘script.php’ :
// if ( isset($_POST[‘whatever’]) && strpos($_SERVER[‘SCRIPT_NAME’], ‘script.php’) !== FALSE ) {
// return ‘BLOCK’;
// }// do not add anything below this line.
- The topic ‘GET /index.php – Access to a script modified/created less than 10 hour(s) ago’ is closed to new replies.
