Bash ShellShock bug – Find out if you’ve been “tested”

Rob —  September 26, 2014 — 3 Comments

We’ve seen the articles about how to find out if you’re vulnerable to the bash shellshock bug, we’ve also seen the articles on how to patch your system.  What I’ll show you is how to find out if people are testing your system.

First, ssh into your server and find your http access logs. Some common places are:
cPanel: /usr/local/apache/domlogs/
Debian/Apache: /var/log/apache2/
CentOS: /var/log/httpd/

Once you find them, you can cat them, grepping for this pattern:

You can make it prettier by using awk…
This will show me the IP addresses that have tried it..

(print $1 means print the first column. Your access log might have the IP in a different column.. try $3 if $1 doesn’t work)

This will show me how many times each IP hit me:

Then, i can take it further by using csf to block anyone who’s tried it:

Related posts from Linux Brigade!

  • Add time and date to your bash historyAdd time and date to your bash history Often, you’ll go looking for a shell command that you used in the past – you can remember around when you did it but of course that won’t help you because by default the bash history won’t […]
  • Lock down your SSH port/accessLock down your SSH port/access The instant a Linux server is connected to a public network it starts getting hit by attackers. There are people out there running programs constantly against IP ranges and they’ve hit […]
  • Reduce TIME_WAIT socket connectionsReduce TIME_WAIT socket connections Some time in your life you’ll run across an Apache server that always has tons of TIME_WAIT connections just seeming to hang out. While these don’t take up as many resources as an […]
  • Migrate CXS license from one server to anotherMigrate CXS license from one server to another When you upgrade servers, you usually like to take things you paid for with you to your new one. This will show you how.

    So you want to migrate CXS license from one server to […]

  • Learn the CSF command line options You have CSF installed and use the GUI to do most things.  (If you don’t have it installed yet, you can read our article on how to install csf).  BUT – knowing the csf (ConfigServer […]

Trackbacks and Pingbacks:

  1. How to patch your Linux system for shell shockLinux News Pro - September 26, 2014

    […] LinuxBrigade has a nice tutorial explaining how to find out of you’ve been ‘tested’ yet by the community.. also, how to auto block them with CSF! Article here: http://www.linuxbrigade.com/bash-shellshock-bug-find-youve-tested/ […]

  2. Bonus bash thoughts but no change on my view, | Bananas in the Falklands - September 27, 2014

    […] from here [not this blog] The scan looks […]

  3. How to patch bash for shell shock in CentOS, Ubuntu, etc.. | PCFlex T.I. - October 7, 2014

    […] LinuxBrigade has a nice tutorial explaining how to find out of you’ve been ‘tested’ yet by the community.. also, how to auto block them with CSF! Article here: http://www.linuxbrigade.com/bash-shellshock-bug-find-youve-tested/ […]

Leave a Reply

Text formatting is available via select HTML.

<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code class="" title="" data-url=""> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong> <pre class="" title="" data-url=""> <span class="" title="" data-url=""> 

*