Info Block MAG Scanning Using Cloudflare

[alqui82]

For those that are using Cloudflare WAF, you can block MAG scanning easily by adding custom rule query string
?type=stb&action=handshake&token=&prehash=0&JsHttpRequest=1-xml

 

[Moutamared]

did you try it ? it works without making issues for legal devices ?

 

[alqui82]

did you try it ? it works without making issues for legal devices ?

I do implement this over 1 year of course it does work, this is not a legimate request.
If attacker change slightly the command you can always check it at even viewer of cloudflare as well.

 

[mrxgodfather]

By doing this using CF-WAF you will be protected against HTTP GET Method Only.


What if the attackers's sending this request using HTTP POST Method Instead of HTTP GET Method

POST /portal.php HTTP/1.1
Host: yourdomain.tld
Content-Type: application/x-www-form-urlencoded
Content-Length: [length]

type=stb&action=handshake&token=&prehash=0&JsHttpRequest=1-xml

using this simple HTTP POST Request You will 100% bypass CF-WAF .

PS: If you are really looking for a solution you need to monitor your traffic manually.

 

[alqui82]

By doing this using CF-WAF you will be protected against HTTP GET Method Only.


What if the attackers's sending this request using HTTP POST Method Instead of HTTP GET Method

POST /portal.php HTTP/1.1
Host: yourdomain.tld
Content-Type: application/x-www-form-urlencoded
Content-Length: [length]

type=stb&action=handshake&token=&prehash=0&JsHttpRequest=1-xml

using this simple HTTP POST Request You will 100% bypass CF-WAF .

PS: If you are really looking for a solution you need to monitor your traffic manually.

I do monitor that why I have a proxy (firewall) middleware between cloudflare and my main.

A genius in a previous thread when i did mention it could not understand it