If the administrator address is /admin, how many times will it be attacked per day?

4,812 times per day for a company with three employees

The access log covered in this section is from a company with three employees. There were attempts to log in to the admin page last night. No. 4,812 I came in. Many people think that because their company is small, they won't be a target of attacks, but in reality, size has nothing to do with it.

admin address /wp-login.phpme /adminIf you leave it at the default value, you will receive this amount per day. This is because, rather than a human being on the attacker's side, checking, the program scans the entire Internet and hits default paths.

not random

If you organize the attempts left in the log by account and password combination, the nature is clearly revealed. Instead of trying to insert just any string, Paste a list of passwords leaked from other sites in order into a common account name. It's the way.

• The account is admin, administrator, values ​​that are easy to guess, such as the front part of the company domain or the English notation of the representative's name, are repeated.
• Passwords are retrieved in order from a list that has already been leaked and made public.
• The interval between sections where attempts are concentrated is 0.4 secondsIt was. This is not the speed at which a human can type by hand.

So, if you are using the same password for your administrator account as you used for another service, there is a possibility that that combination is already in the list.

All it takes is one hit out of 4,812 times.

The log contains a long series of 401 responses, followed by a single line of 302 responses. It means that authentication was successful. And from the very next line, a file upload request appears.

From this point on, the number of login attempts loses meaning. The party that gains administrator privileges uploads a web shell and continues to create spam pages using the web shell. How does the flood of unfamiliar pages in search results begin? How to check if your website has been hacked in 10 secondsIt was covered in .

Confirmation is one line

You can count how many times the administrator address has been called in the access log.

grep -c "wp-login.php" /var/log/nginx/access.log
awk '/wp-login/{print $1}' access.log | sort | uniq -c | sort -rn

The first line counts the total number of calls, and the second line shows which IPs were tapped and how many, in which order. If your site does not use WordPress wp-login.php in place /admin, /managerLike this, you need to enter the administrator path you actually use and count it.

If the number of calls per day exceeds hundreds, it has not yet been breached, but has already become a target.

Four actions to take immediately

1. Replace the administrator address from the default. /wp-login.phpand /adminIf you move it to a path that only the company knows about, most automated attempts won't get there.
2. Turn on two-step verification. Even if the password is correct, you will be blocked once more.
3. Limits accessible IPs. If you only allow your office and VPN bandwidth to reach the admin page, any remaining requests will be cut straight to the server.
4. Automatic blocking based on number of failures. Set the server to directly reject IPs that have failed 5 times for a certain period of time.

You must apply the four together to be effective. Simply changing your password to a longer password will not reduce the number of attempts. Since the method uses a list that has already been leaked, increasing the length only lowers the probability of success and does not prevent the act of tapping.