---
id: d4b1b2c3-24be-4564-b9ea-fbb96dccffa3
---

# Apache HTTP Server Port Scanning Incident
---

An Apache HTTP Server Port Scanning Incident refers to a situation where an unauthorized individual or system is attempting to scan the open ports on a server running Apache HTTP software. This type of incident is typically seen as a security threat and could be an attempt to exploit vulnerabilities in the server or steal sensitive information. It is crucial to detect and address these incidents swiftly to prevent potential harm to the system and its users.

### Parameters
```shell

export DOCUMENT_ROOT_DIRECTORY="PLACEHOLDER"

export APACHE_ACCESS_LOG_PATH="PLACEHOLDER"

export APACHE_ERROR_LOG_PATH="PLACEHOLDER"

```

## Debug

### Check if Apache HTTP server is running
```shell
systemctl status apache2
```

### Check if Apache HTTP server is listening on the expected port
```shell
sudo netstat -tuln | grep 443
```

### Check if there are any suspicious processes running on the system
```shell
ps aux 
```

### Check if there are any suspicious files in the Apache document root directory
```shell
sudo find ${DOCUMENT_ROOT_DIRECTORY} -type f -name "*.php" -o -name "*.sh"
```

### Check Apache access logs for any suspicious activity
```shell
sudo tail -1000f ${APACHE_ACCESS_LOG_PATH}
```

### Check Apache error logs for any suspicious activity
```shell
sudo tail -1000f ${APACHE_ERROR_LOG_PATH}
```

## Repair

### Block the IP address or range that initiated the port scanning activity using a firewall or network security device to prevent further scanning attempts.
```shell


#!/bin/bash



# Set the IP address or range to be blocked

IP_ADDRESS=${IP_ADDRESS_OR_RANGE}



# Block the IP address or range using iptables

iptables -A INPUT -s $IP_ADDRESS -j DROP



# Save the iptables configuration

iptables-save > /etc/sysconfig/iptables



# Restart the iptables service to apply the changes

systemctl restart iptables


```

### Implementing rate limiting in Apache HTTP Server
```shell


#!/bin/bash



# Set variables

APACHE_CONFIG_FILE="${PATH_TO_APACHE_CONFIG_FILE}"

MAX_CONNECTIONS="${MAX_CONNECTIONS_PER_IP}"

TIME_INTERVAL="${TIME_INTERVAL}"



# Backup config file

cp $APACHE_CONFIG_FILE "$APACHE_CONFIG_FILE.bak"



# Add rate limiting configuration to Apache config file

echo "LimitRequestBody 102400" >> $APACHE_CONFIG_FILE

echo "LimitRequestFields 50" >> $APACHE_CONFIG_FILE

echo "LimitRequestFieldSize 8190" >> $APACHE_CONFIG_FILE

echo "LimitRequestLine 8190" >> $APACHE_CONFIG_FILE

echo "LimitXMLRequestBody 102400" >> $APACHE_CONFIG_FILE

echo "MaxConnPerIP $MAX_CONNECTIONS" >> $APACHE_CONFIG_FILE

echo "TimeOut $TIME_INTERVAL" >> $APACHE_CONFIG_FILE



# Restart Apache

systemctl restart apache2.service


```

An Apache HTTP Server Port Scanning Incident refers to a situation where an unauthorized individual or system is attempting to scan the open ports on a server running Apache HTTP software. This type of incident is typically seen as a security threat and could be an attempt to exploit vulnerabilities in the server or steal sensitive information. It is crucial to detect and address these incidents swiftly to prevent potential harm to the system and its users.


A DoS (Denial of Service) attack on a Tomcat server occurs when attackers flood the server with an overwhelming amount of traffic, causing the server to become unresponsive and unable to handle legitimate requests. This attack results in service disruptions, making the server unavailable to users. The goal of the DoS attack is to make the targeted service unavailable to its users, causing inconvenience or financial losses to the organization that operates the server.


DoS Attack on Tomcat Server

This incident type refers to an unauthorized access to directories in Apache HTTPD, which is a widely used web server software. It means that someone was able to access files or directories that they were not supposed to, without having proper authorization. This type of incident can potentially lead to sensitive data being exposed or even stolen, and can compromise the security of the server and the applications running on it.


Unauthorized Directory Access in Apache HTTPD.

The Slowloris Attack is a type of Denial of Service (DoS) attack that exploits a vulnerability in the Apache web server. It works by sending HTTP requests to the server and keeping those connections open for as long as possible, thereby using up all the available resources of the server and rendering it unresponsive to legitimate requests. As a result, the server becomes slow or unresponsive, causing downtime for the affected website or service. This type of attack can be detected and mitigated by implementing specific security measures and tools.


Slowloris Attack Detected on Apache server.

This incident type refers to the detection of SQL injection attempts in Apache web server logs. SQL injection is a type of cyber attack that exploits vulnerabilities in web applications allowing attackers to execute malicious SQL statements. In this incident, attackers are attempting to inject SQL code into the URI (Uniform Resource Identifier) of an Apache web server, potentially compromising the server's security and exposing sensitive information.


Apache SQL Injection Attempts in URI Incident

This incident type refers to a security vulnerability in the SSL/TLS configuration of the Apache HTTP Server, which can leave the server and its users vulnerable to attacks. The SSL/TLS configuration is responsible for encrypting the communication between the server and its clients, and if it is not configured properly, it can be exploited by hackers to intercept or modify sensitive data. This type of incident requires immediate attention from software engineers to ensure that the SSL/TLS configuration is properly configured to prevent any potential security threats.


Inadequate SSL/TLS Configuration for Apache HTTP Server.

```shell

export DOCUMENT_ROOT_DIRECTORY="PLACEHOLDER"

export APACHE_ACCESS_LOG_PATH="PLACEHOLDER"

export APACHE_ERROR_LOG_PATH="PLACEHOLDER"

```


### Check if Apache HTTP server is running

```shell
systemctl status apache2
```

### Check if Apache HTTP server is listening on the expected port

```shell
sudo netstat -tuln | grep 443
```

### Check if there are any suspicious processes running on the system

```shell
ps aux 
```

### Check if there are any suspicious files in the Apache document root directory

```shell
sudo find ${DOCUMENT_ROOT_DIRECTORY} -type f -name "*.php" -o -name "*.sh"
```

### Check Apache access logs for any suspicious activity

```shell
sudo tail -1000f ${APACHE_ACCESS_LOG_PATH}
```

### Check Apache error logs for any suspicious activity

```shell
sudo tail -1000f ${APACHE_ERROR_LOG_PATH}
```


### Block the IP address or range that initiated the port scanning activity using a firewall or network security device to prevent further scanning attempts.

```shell


#!/bin/bash



# Set the IP address or range to be blocked

IP_ADDRESS=${IP_ADDRESS_OR_RANGE}



# Block the IP address or range using iptables

iptables -A INPUT -s $IP_ADDRESS -j DROP



# Save the iptables configuration

iptables-save > /etc/sysconfig/iptables



# Restart the iptables service to apply the changes

systemctl restart iptables


```

### Implementing rate limiting in Apache HTTP Server

```shell


#!/bin/bash



# Set variables

APACHE_CONFIG_FILE="${PATH_TO_APACHE_CONFIG_FILE}"

MAX_CONNECTIONS="${MAX_CONNECTIONS_PER_IP}"

TIME_INTERVAL="${TIME_INTERVAL}"



# Backup config file

cp $APACHE_CONFIG_FILE "$APACHE_CONFIG_FILE.bak"



# Add rate limiting configuration to Apache config file

echo "LimitRequestBody 102400" >> $APACHE_CONFIG_FILE

echo "LimitRequestFields 50" >> $APACHE_CONFIG_FILE

echo "LimitRequestFieldSize 8190" >> $APACHE_CONFIG_FILE

echo "LimitRequestLine 8190" >> $APACHE_CONFIG_FILE

echo "LimitXMLRequestBody 102400" >> $APACHE_CONFIG_FILE

echo "MaxConnPerIP $MAX_CONNECTIONS" >> $APACHE_CONFIG_FILE

echo "TimeOut $TIME_INTERVAL" >> $APACHE_CONFIG_FILE



# Restart Apache

systemctl restart apache2.service


```


Apache HTTP Server Port Scanning Incident

Overview

Parameters

Debug

Check if Apache HTTP server is running

Check if Apache HTTP server is listening on the expected port

Check if there are any suspicious processes running on the system

Check if there are any suspicious files in the Apache document root directory

Check Apache access logs for any suspicious activity

Check Apache error logs for any suspicious activity

Repair

Block the IP address or range that initiated the port scanning activity using a firewall or network security device to prevent further scanning attempts.

Implementing rate limiting in Apache HTTP Server

Learn more

Related Runbooks

DoS Attack on Tomcat Server

Unauthorized Directory Access in Apache HTTPD.

Slowloris Attack Detected on Apache server.

Apache SQL Injection Attempts in URI Incident

Support