Block DDoS attack with .htaccess






In this post we will see how to block a Denial-of-service attack on our .htaccess file.

Seeing that many scripts use the same method…

http://urlvictim.com/?1234567890
http://urlvictim.com/?0.1234567890
http://urlvictim.com/page1.html?0.1234567890

(random number)

We use .htaccess to block DDoS. We just have to add this code at the beginning of htaccess

Send the attack on the user’s IP


RewriteEngine on
RewriteCond %{QUERY_STRING} ^([0-9]+)$ [NC,OR]
RewriteCond %{QUERY_STRING} ^(.*)\?([0-9]+)(.*)$ [NC,OR]
RewriteCond %{QUERY_STRING} ^([0-9]+\.[0-9])(.*)$ [NC,OR]
RewriteCond %{QUERY_STRING} ^(.*)\?([0-9]+\.[0-9])(.*)$ [NC]
RewriteRule ^(.*)$ http://%{REMOTE_ADDR} [L]

Send referer attack (hence the attack)


RewriteEngine on
RewriteCond %{QUERY_STRING} ^([0-9]+)$ [NC,OR]
RewriteCond %{QUERY_STRING} ^(.*)\?([0-9]+)(.*)$ [NC,OR]
RewriteCond %{QUERY_STRING} ^([0-9]+\.[0-9])(.*)$ [NC,OR]
RewriteCond %{QUERY_STRING} ^(.*)\?([0-9]+\.[0-9])(.*)$ [NC]
RewriteRule ^(.*)$ %{HTTP_REFERER} [L]

Send an attack on a specific site


RewriteEngine on
RewriteCond %{QUERY_STRING} ^([0-9]+)$ [NC,OR]
RewriteCond %{QUERY_STRING} ^(.*)\?([0-9]+)(.*)$ [NC,OR]
RewriteCond %{QUERY_STRING} ^([0-9]+\.[0-9])(.*)$ [NC,OR]
RewriteCond %{QUERY_STRING} ^(.*)\?([0-9]+\.[0-9])(.*)$ [NC]
RewriteRule ^(.*)$ http://urlsite.com/ [L]



 
Leave a Comment
Your comment: