tech-probe Free

Fingerprinting a technology by its tell-tale paths (consoles, version files, vendor directories) the site does not have — reconnaissance for an exploit

Category

web

Threshold

1/10m

Ban policy

exploit

Report

tech-probe

Parsers

http-tech-probe

Why it is written this way

The rule file View raw

# Technology fingerprinting: a refused request for a vendor path —
# admin panels, consoles, appliance endpoints (Kibana, Jenkins,
# phpMyAdmin setups…). CrowdSec's http-technology-probing marks it
# "no remediation" upstream; the shared-hosting fleet this pack comes
# from bans it on sight through its profile, and so does this rule.
# The same 404s also feed http-probing; this one names WHAT was probed
# for, so the record says "looked for Kibana" instead of "eleven 404s".
rule: tech-probe
description: "Fingerprinting a technology by its tell-tale paths (consoles, version files, vendor directories) the site does not have — reconnaissance for an exploit"
about:
  purpose: >-
    Ban a scanner at the first path it asks for, when that path only exists in software you do not run.
  blocks: >-
    ONE request for a vendor's own path — a VMware endpoint, a WSO2 upload servlet, a Drupal installer, a router's CGI. Nobody browses to those by accident.
  applies_to: >-
    Any web server.
  requires:
    - >-
      The site's access log in combined format, declared as `log: http`.
  beware:
    - >-
      If you DO run one of those products at that exact path, its own users would be banned. The list is of paths a site normally has no business serving; check it against what you host.
category: web
parsers: http-tech-probe
threshold: 1/10m
ban: exploit
report: tech-probe