---
title: "Liste des IP qui essayent d’exploiter la faille Outlook Web Access (OWA) : « /owa/auth/logon.aspx »"
url: https://www.cyber-neurones.org/2021/07/liste-des-ip-qui-essayent-dexploiter-la-faille-outlook-web-access-owa-owa-auth-logon-aspx/
date: 2021-07-29
modified: 2021-07-29
author: "Frederic"
description: "Un exemple de logs : 192.241.211.240 - - [29/Jul/2021:11:51:11 +0200] \"GET /owa/auth/logon.aspx?url=https%3a%2f%2f1%2fecp%2f HTTP/1.1\" 302 4949 \"-\" \"Mozilla/5.0 zgrab/0.x\" La liste des IP : # zgrep \"/owa/auth/logon.aspx\" /var/log/apache2/access.humhub.log.*gz | sed 's/:/..."
categories:
  - "Sécurité"
tags:
  - "iptables"
word_count: 175
---

# Liste des IP qui essayent d’exploiter la faille Outlook Web Access (OWA) : « /owa/auth/logon.aspx »

Un exemple de logs :
192.241.211.240 - - [29/Jul/2021:11:51:11 +0200] "GET /owa/auth/logon.aspx?url=https%3a%2f%2f1%2fecp%2f HTTP/1.1" 302 4949 "-" "Mozilla/5.0 zgrab/0.x"

La liste des IP :
**# zgrep "/owa/auth/logon.aspx" /var/log/apache2/access.humhub.log.*gz | sed 's/:/ /g' | awk '{print $2}' | sort -n | uniq | awk '{print "/usr/sbin/iptables -A INPUT -s " $1 " -j DROP "}'**
/usr/sbin/iptables -A INPUT -s 13.52.99.132 -j DROP
/usr/sbin/iptables -A INPUT -s 92.154.95.236 -j DROP
/usr/sbin/iptables -A INPUT -s 192.241.202.155 -j DROP
/usr/sbin/iptables -A INPUT -s 192.241.202.30 -j DROP
/usr/sbin/iptables -A INPUT -s 192.241.204.132 -j DROP
/usr/sbin/iptables -A INPUT -s 192.241.206.232 -j DROP
/usr/sbin/iptables -A INPUT -s 192.241.208.28 -j DROP
/usr/sbin/iptables -A INPUT -s 192.241.209.114 -j DROP
/usr/sbin/iptables -A INPUT -s 192.241.210.206 -j DROP
/usr/sbin/iptables -A INPUT -s 192.241.210.44 -j DROP
/usr/sbin/iptables -A INPUT -s 192.241.218.70 -j DROP
/usr/sbin/iptables -A INPUT -s 192.241.219.54 -j DROP
/usr/sbin/iptables -A INPUT -s 192.241.221.104 -j DROP
/usr/sbin/iptables -A INPUT -s 192.241.221.238 -j DROP
/usr/sbin/iptables -A INPUT -s 192.241.221.249 -j DROP

Maintenant je filtre 213 IP publiques :
**# cat /etc/iptables/rules.v4 | grep "DROP" | wc -l**
213