Wordfence Alert: Increased Attack Rate

  • Resolved fotske

    (@fotske)


    6 years, 4 months ago

    Hi,

    I received this email from Wordfence:

    “The Wordfence Web Application Firewall has blocked 132 attacks over the last 10 minutes. Below is a sample of these recent attacks:

    novembre 1, 2018 10:10 109.73.229.120 (Bulgaria) Blocked for XSS: Cross Site Scripting in POST body: _mc4wp_form_id=1166″ onMouseOver=–>”>’>'”<vvv002058v809190>
    novembre 1, 2018 10:10 109.73.229.120 (Bulgaria) Blocked for Directory Traversal in POST body: _mc4wp_form_id=/../../../../../../../../../../../../etc/passwd
    novembre 1, 2018 10:10 109.73.229.120 (Bulgaria) Blocked for XSS: Cross Site Scripting in POST body: _mc4wp_form_id=1166′ onMouseOver=–>”>’>'”<vvv002060v809190>
    novembre 1, 2018 10:10 171.6.249.97 (Thailand) Blocked for XSS: Cross Site Scripting in POST body: _mc4wp_honeypot=1″ onMouseOver=–>”>’>'”<vvv001818v809190>
    novembre 1, 2018 10:10 171.6.249.97 (Thailand) Blocked for XSS: Cross Site Scripting in POST body: _mc4wp_honeypot=1′ onMouseOver=–>”>’>'”<vvv001820v809190>
    novembre 1, 2018 10:10 171.6.249.97 (Thailand) Blocked for LFI: Local File Inclusion in POST body: _mc4wp_honeypot=/etc/passwd
    novembre 1, 2018 10:10 171.6.249.97 (Thailand) Blocked for XSS: Cross Site Scripting in query string: attachment_id=539′ onMouseOver=–>”>’>'”<vvv001804v809190>
    novembre 1, 2018 10:10 171.6.249.97 (Thailand) Blocked for XSS: Cross Site Scripting in query string: attachment_id=539″ onMouseOver=–>”>’>'”<vvv001802v809190>
    novembre 1, 2018 10:10 171.6.249.97 (Thailand) Blocked for SQL Injection in POST body: _mc4wp_form_element_id=mc4wp-form-1′ UNION SELECT 8, table_name, ‘vega’ FROM information_schema.taables WHERE taable_name lê
    novembre 1, 2018 10:10 171.6.249.97 (Thailand) Blocked for SQL Injection in POST body: _mc4wp_form_element_id=mc4wp-form-1′ UNION SELECT 8, table_name, ‘vega’ FROM information_schema.tables WHERE table_name likê”

    What is it and what should I do to protect my website?

    Thank you very much in advance for your help.

    Best regards

Viewing 1 replies (of 1 total)

  • Hi @fotske,

    Your website has been protected against those attacks. I’ll explain what can happen if these attacks were not blocked.

    1) Blocked for XSS: Cross Site Scripting in POST body

    This attempts to see if posting some JavaScript to the server results in the server directly echoing back the JavaScript or not. If it does, then an attacker can get a victim to post something, and have that script run on the victim’s browser.

    2) Blocked for Directory Traversal in POST body: _mc4wp_form_id=/../../../../../../../../../../../../etc/passwd

    If your form_id was reading a file, this would attempt to go back 12 directory folders and attempt to read the passwords file on a unix machine.

    3) Blocked for LFI: Local File Inclusion in POST body: _mc4wp_honeypot=/etc/passwd

    Similar to 2), but this uses an absolute path to attempt to read the passwords file.

    4) Blocked for SQL Injection in POST body: _mc4wp_form_element_id=mc4wp-form-1′ UNION SELECT 8, table_name, ‘vega’ FROM information_schema.taables

    This attack attempts to try to attach itself onto your query to find all other tables in your database.

    So it looks like some random bots were just testing to see if your site was vulnerable or not, and Wordfence blocked the attacks. You don’t need to do anything else.

    Dave

Viewing 1 replies (of 1 total)
  • The topic ‘Wordfence Alert: Increased Attack Rate’ is closed to new replies.