Nginx + PHP-FPM starts crashing after suspicious pentesting request with hexadecimal http verb/method

codeneuss

1/21/23, 9:38 PM

my server crashes everytime an annoying pentester tries to find security-holes in my application. I see this in the errorlog:

17:48:48 +0200] "\x16\x03\x01\x00M\x01\x00\x00I\x03\x03\xDBJA\xC5\xB17\xF6\xDA \xD4\xEEEg0\xE0\xF2\xF2\xC9S\xE4\xF9v}\x1E\x00\xC8\xC3d\x 80h;= \x1F\xD2\xAF?\x88\x8A\xA2\xCF\x16G\x99\x1D\x91" 400 173 "-" "-"

The server is configured like a normal nginx + php-fpm server. Port 80 is redirected to 443 and ssl ist configured correctly.

I also added this line:

if ($request_method !~ ^(GET|HEAD|POST|OPTIONS|DELETE|PUT|PATCH)$) { return 405; }

(in both server-configurations)

This is also the only "pentesting" request that results in a 400. All other requests results in 301 or 404. I found a similar issue where the ssl section of nginx is not configured correctly. I checked my configuration but it looks alright.

I have the same issue on another server that has a similar configuration and on a server that has a nginx -> apache_mpm_prefork_fpm config.

Any ideas what this is and how to protect the server from crashing. How to reproduce such a pentesting request (I tried it in postman but I got a different result).

Thx alot.

EDIT

I figured out how to reproduce that log: https://servername:80.

But I can't figure out how block this kind of requests. I tried it with $scheme but the request is encrypted. I tried to add ssl to the config but nothing changed. There must be a reason why those pentesting/exploid-sites try to send a https request to port 80.

0 + 0

linux

nginx

web-server

php-fpm

mpm-prefork

Michael Hampton

1/21/23, 11:46 PM

This does not look like pentesting. It looks like someone has tried to connect to an HTTP port using HTTPS. Check your nginx configuration.

codeneuss

1/22/23, 7:54 AM

well it's actually pentesting / scanning or however you call it. There a lot other requests from the same ip thats looking for exploits. But your comment helps to reproduce it. "Check your nginx config" doesn't help. I did that for half a year now.

Michael Hampton

1/22/23, 12:53 PM

Nginx is already rejecting those requests. What more do you want?

Michael Hampton

1/22/23, 1:14 PM

And, what do you mean by crashing? You've shown nothing in your post about a crash.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Nginx + PHP-FPM starts crashing after suspicious pentesting request with hexadecimal http verb/method

TH: Nginx + PHP-FPM เริ่มทำงานล้มเหลวหลังจากคำขอ pentesting ที่น่าสงสัยด้วย http verb/method เลขฐานสิบหก

RO: Nginx + PHP-FPM începe să se blocheze după o solicitare suspectă de pentesting cu verb/metodă http hexazecimal

RU: Nginx + PHP-FPM начинает сбой после подозрительного запроса на пентестирование с шестнадцатеричным HTTP-глаголом/методом

VI: Nginx + PHP-FPM bắt đầu gặp sự cố sau khi yêu cầu dồn nén đáng ngờ với động từ/phương thức http thập lục phân

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.