快速判断Web站点是否被CC攻击(Linux主机篇)-阿里云服务器优惠网!
阿里云最新优惠活动

快速判断Web站点是否被CC攻击(Linux主机篇)

阿里云服务器优惠

简介:

CC攻击非常简单,不需要什么技术即可发起;且成本低廉。从网上下载一个攻击器即可发起。现在的新手站长往往不具备分析日志的水平;在网站访问越来越慢的情况下,无法判断网站是否遭遇攻击。本教程给出3条判断命令;通过这3条命令可以很方便的知道网站是否遭受CC攻击。

命令安装:

一般情况下系统不会默认安装tcpdump命令,需要自行安装。

  • Centos安装方法:

    yum install -y tcpdump
  • debian/ubuntu安装方法:

    apt-get install -y tcpdump

判断方法:

  • 第一条命令:​

    tcpdump -s0 -A -n -i any | grep -o -E '(GET|POST|HEAD) .*'
  • 正常的输出如下:

  • POST /ajax/validator.php HTTP/1.1 
    POST /api_redirect.php HTTP/1.1 
    GET /team/57085.html HTTP/1.1 
    POST /order/pay.php HTTP/1.1 
    GET /static/goodsimg/20140324/1_47.jpg HTTP/1.1 
    GET /static/theme/qq/css/index.css HTTP/1.1 
    GET /static/js/index.js HTTP/1.1 
    GET /static/js/customize.js HTTP/1.1 
    GET /ajax/loginjs.php?type=topbar& HTTP/1.1 
    GET /static/js/jquery.js HTTP/1.1 
    GET /ajax/load_team_time.php?team_id=57085 HTTP/1.1 
    GET /static/theme/qq/css/index.css HTTP/1.1 
    GET /static/js/lazyload/jquery.lazyload.min.js HTTP/1.1 
    GET /static/js/MSIE.PNG.js HTTP/1.1 
    GET /static/js/index.js HTTP/1.1 
    GET /static/js/customize.js HTTP/1.1 
    GET /ajax/loginjs.php?type=topbar& HTTP/1.1 
    GET /static/theme/qq/css/i/logo.jpg HTTP/1.1 
    GET /static/theme/qq/css/i/logos.png HTTP/1.1 
    GET /static/theme/qq/css/i/hot.gif HTTP/1.1 
    GET /static/theme/qq/css/i/brand.gif HTTP/1.1 
    GET /static/theme/qq/css/i/new.gif HTTP/1.1 
    GET /static/js/jquery.js HTTP/1.1 
    GET /static/theme/qq/css/i/logo.jpg HTTP/1.1 
  • 如果网站正常,那么在日志里面看见的都是一些静态文件,如图片,CSS,JS等。如果被攻击,就会出现大量的固定链接,会出现大量含有一定特征的地址。例如Discuz类的站点被攻击,就会出现大量类似于/thread-随机数字-1-1.html的地址。

  • 第二条命令:​

    tcpdump -s0 -A -n -i any | grep  ^User-Agent;
  • 正常的输出如下:

  • User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) 
    User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) 
    User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1 
    User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1 
    User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) 
    User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) 
    User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) 
    User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) 
    User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1 
    User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1 
    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; 360space) 
    User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1 
    User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1 
    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; 360space) 
    User-Agent: Mozilla/5.0 (compatible; bingbot/2.0; +https://www.bing.com/bingbot.htm) 
    User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1 
    User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1 
    User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1 
    User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) 
    User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) 
    User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) 
    User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) 
    User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) 
    User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) 
    User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1 
    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0) 
    User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) 
    User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) 
    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; InfoPath.2) 
    User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) 
  • 这个命令可以查看客户端的useragent;目前大量的CC攻击采用CC攻击工具实现;他们的客户端的useragent往往都是一致的;在遭受到CC攻击的往往会看到同一个useragent在刷屏。

  • 第三条命令:​

    tcpdump -s0 -A -n -i any | grep ^Host ;
  • 正常的输出如下:

  • Host: www.57aliyun.com 
    Host: www.57aliyun.com 
    Host: www.57aliyun.com 
    Host: upload.57aliyun.com 
    Host: upload.57aliyun.com 
    Host: upload.57aliyun.com 
    Host: upload.57aliyun.com 
    Host: upload.57aliyun.com 
    Host: upload.57aliyun.com 
    Host: upload.57aliyun.com 
    Host: upload.57aliyun.com 
    Host: upload.57aliyun.com 
    Host: www.57aliyun.com 
    Host: upload.57aliyun.com 
    Host: upload.57aliyun.com 
    Host: upload.57aliyun.com 
    Host: www.57aliyun.com 
    Host: www.57aliyun.com 
    Host: upload.57aliyun.com 
    Host: upload.57aliyun.com 
    Host: upload.57aliyun.com 
    Host: www.57aliyun.com 
    Host: upload.57aliyun.com 
    Host: upload.57aliyun.com 
    Host: www.57aliyun.com 
     
  • 当同一服务器上存在大量站点时,使用该命令可以快速判断遭受CC攻击的域名。

赞(0)

评论 抢沙发

  • 昵称 (必填)
  • 邮箱 (必填)
  • 网址

买云服务器上,云就上阿里云!

平板电脑什么牌子好买书去哪个网站比较好