Skip to content

Instantly share code, notes, and snippets.

@win0err
Last active February 9, 2021 07:10
Show Gist options
  • Save win0err/4ddc1d662276675f0719df9d7d6459f0 to your computer and use it in GitHub Desktop.
Save win0err/4ddc1d662276675f0719df9d7d6459f0 to your computer and use it in GitHub Desktop.
Blocks IPs from Jorgee Security Scanner searching for vulnerabilities on a server
#!/usr/bin/env bash
printf "Searching in Apache2 and nginx access logs for Jorgee's scans";
zcat -f /var/log/{apache2,nginx}/access.*\
| grep Jorgee \
| grep -oE '^([0-9]{1,}\.){3}[0-9]{1,}' \
| sort -n \
| uniq \
| awk '{ system("iptables -A INPUT -s " $0 " -j DROP"); printf "."; }'
printf "\nAdding an iptables rule for Jorgee's user-agent.";
sudo iptables -A INPUT -m string --algo bm --string "User-Agent: Mozilla/5.0 Jorgee" -j DROP
printf "\nDone\n";
@acosonic
Copy link

acosonic commented Feb 9, 2021

Can you rewrite this as a Fail2Ban rule ?

I've found some other URL's but they seem to fail detecting Jorge?

https://dave.moskovitz.co.nz/2017/09/05/knocking-vulnerability-scanners-with-fail2ban/
https://gauss-development.com/fail2ban/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment