Internet Storm Center

Summary

The 404Project collects "Page Not Found" errors from web servers. To particiapte, use our Raspberry Pi Honeypot, or add one of the code snippets below to your custom 404 error page.

We started the project to find an easy way to look at web application attack trends. Attackers often search for vulnerable applications, and in the process generate 404 errors on sites that do not use these applications. The error logs give us an insight into what vulnerabilities attackers attempt to exploit.

Current Reports

You must have an ISC Portal ID and API Key to use this tool. Once logged in and submitting data, you can view your honeypot web logs. Jump to the Instructions to get started!

The following fields are collected in addition to being stored with the date, time and your credentials:

• Full request URL including parameters ($_SERVER['REQUEST_URI'])
• Client IP address ($_SERVER['REMOTE_ADDR'])
• Client User-Agent ($_SERVER['HTTP_USER_AGENT'])

Optionally you can mask an IP for privacy or legal concerns. Mask ranges from 0xff000000/8 to no mask 0xffffffff/32 can be applied.

Please contact us with feedback or if you experience and trouble or need further assistance setting this up.

Instructions

1. Sign Up for an ISC account or, if you are currently a member, login and visit My Account then go to the next step
2. Note your userID number in the right column under "Logged in as:" on My Account
3. Note your "Your Authentication Key:" in section My Account
4. Paste this PHP code snippet into your 404 error page
   <?php /* * SANS ISC 404Project v2 * * http://isc.sans.edu/tools/404project.html * * Purpose: Collect 404 Page Not Found to compile * list for potential crawler trends * * Instructions: Enter the following from https://isc.sans.edu/myaccount.html * for the variables below * $sMyUserID - in right-column under "Logged in as:" * $sMyKey - in section https://isc.sans.edu/myaccount.html * labeled "Your Authentication Key:" * * Updates: * v1 - Initial Release * v2 - add IP Mask (2012-07-26) */ # you shouldset thetime zone in php.ini. but if not, use this linefor php5 # date_default_timezone_set('UCT'); $showError=0; #1=show, 0=hide # the user id is usually a number, like 1234567 $sMyUserID='[Your ISC ID]'; $sMyKey='[Your Authentication Key]'; /* * Privacy note: REQUEST_URI will incldue the query string. If you do not * feel comfortable with this, replace it with REDIRECT_URL */ $sURL=$_SERVER['REQUEST_URI']; # for more privacy, replace this with 'REDIRECT_URL' $sIP=$_SERVER['REMOTE_ADDR']; $sUA=$_SERVER['HTTP_USER_AGENT']; /* RECOMMENDED: Change the URL to HTTPS. But first test if curl deals * with https correctly */ $sSubmitSite='http://isc.sans.edu/'; /* Set IP Mask * Default = 0xffffffff/32 * Can be set to any level combination * such as 0xffffff00/24 or 0xffff0000/16 or 0xff000000/8 * or mix it up a little with 0x00ffffff */ $sIPMask = "0xffffffff"; /* * Applies IP Mask */ $sIP = long2ip(ip2long($sIP) & hexdec($sIPMask)); /* * This code will limit submissions to one per minute. * It can prevent some DoS conditions. (thx Swa for pointing this out) * requires a temporary file to use for locking. * Feel free to change the file name. * (yup. I could use shared memory / semaophores but they are not always * enabled) */ $sLockFile=sys_get_temp_dir().'/404project.lock'; if ( file_exists($sLockFile )) { if ( time()-filemtime($sLockFile)<60 ) { exit(); } } $fp=fopen($sLockFile,'w'); fwrite($fp,time()."\n"); fclose($fp); $sSubmitURL="weblogs/404project.html?id=$sMyUserID&version=2"; $sData=$sMyUserID.chr(0).$sMyKey.chr(0).$sURL.chr(0).$sIP.chr(0).$sUA.chr(0).date('Y-m-d').chr(0).date('H:i:s').chr(0).$sIPMask; $sData='DATA='.base64_encode($sData); if( $sURL != "" ){ $ch=curl_init($sSubmitSite.$sSubmitURL); curl_setopt($ch,CURLOPT_RETURNTRANSFER,1); curl_setopt($ch,CURLOPT_POST,1); curl_setopt($ch,CURLOPT_POSTFIELDS,$sData); $output=curl_exec($ch); if ( curl_errno($ch)!=0 ) { error_log("404 Project CURL Error ".curl_errno($ch)." ".curl_error($ch)); } curl_close($ch); } ?>
5. In the code, update [Your ISC ID] and [Your Authentication Key] with the info you noted from My Account

Alternative Languages

Perl
• Edward created this 404Project PERL port [1] of the code after learning of our 404Project from a post on the Emerging Threats Signature Discussion.

Python
• Steve Milner posted a Python port [1] of the code. SHA1SUM: 12394939d264d7c10531f781b9184dfd2d1435c1

.NET
• Joseph Faust created a .NET port [1] of the code.

Javascript
• Joachim Kainz posted the node-404project [1].

[1] Indicates code not developed or maintained by the Internet Storm Center. Please evaluate carefully and contact the developer directly for support.