Question

一个废弃的过时的wordpress网站，我以为互联网不知道被黑了。攻击很快得到解决，就我现在所知，并没有造成实际损失。但这确实提供了研究所用攻击的机会。

引起我注意的一件事是，上传了恶意的sitemap.xml，导致google对符合特定格式的奇怪url进行了许多（每天25万次）请求。 6位-8位-6个字符的十六进制

示例：

66.249.76.33 - - [03/Oct/2018:14:12:13 +0200] "GET /035742-41258563-3329f7 HTTP/1.1" 302 244 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.96 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
66.249.76.33 - - [03/Oct/2018:14:12:13 +0200] "GET /042913-72193084-e8a20a HTTP/1.1" 302 244 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.96 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
66.249.76.33 - - [03/Oct/2018:14:12:14 +0200] "GET /012527-34165946-30e419 HTTP/1.1" 302 244 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.96 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
66.249.76.33 - - [03/Oct/2018:14:12:14 +0200] "GET /064248-52623737-8691d5 HTTP/1.1" 302 244 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.96 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
66.249.64.2 - - [03/Oct/2018:14:12:15 +0200] "GET /052839-44405924-68722a HTTP/1.1" 302 244 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.96 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
66.249.64.2 - - [03/Oct/2018:14:12:15 +0200] "GET /065830-65437791-de5b61 HTTP/1.1" 302 244 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.96 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
66.249.76.33 - - [03/Oct/2018:14:12:16 +0200] "GET /013227-70693694-023293 HTTP/1.1" 302 244 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.96 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
66.249.76.33 - - [03/Oct/2018:14:12:16 +0200] "GET /125539-43521853-8481a2 HTTP/1.1" 302 244 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.96 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
66.249.76.33 - - [03/Oct/2018:14:12:17 +0200] "GET /033515-14477539-24816a HTTP/1.1" 302 244 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.96 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
66.249.76.33 - - [03/Oct/2018:14:12:17 +0200] "GET /104450-28458335-28053c HTTP/1.1" 302 244 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.96 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"

我已经通过使用host and ping验证了它是真正的Google机器人。我很好奇，是否有人以前见过这种攻击及其作用方式！

Answer 1

以前从未见过这种攻击，但是它的执行非常简单：上载由随机生成的“页面网址”组成的大规模站点地图，然后由Google完成其余工作。

Google会“瞧瞧，他们一定已经添加了很多新内容，我想要这样”，并将大量访问该网站以尝试获取它，从而使该网站瘫痪。我们一直在将大型网站带入新的网址结构时看到这种情况。

我发现要补偿的唯一方法是使用NGINX速率限制来阻止任何单个IP每秒发出太多请求。

奇怪的Google机器人攻击（例如/ 123456-12345678-123abc）

1 个答案: