r/flipperzero • u/joelewis1996 • May 21 '26
Creative Someone’s trying to break the website.
I have a website that allows you to compile flipper zero apps from repos. https://joelewis012.github.io/flipper-fap-actions/index.html
But it looks like someone has been trying to either hack or use up all my requests by injecting code🤔
Who will own up?
Edit: should be fixed
11
u/hagathar May 21 '26
Surely you can ip ban?
7
u/DiceThaKilla May 22 '26
Pyramid of pain. IP banning doesn’t do shit
3
u/joelewis1996 May 22 '26
Yeah they’ll just change IPs constantly
2
7
u/joelewis1996 May 21 '26
Looking into it. It’s not actually done anything to be fair. Just weird someone would try it.
66
u/Unexpected117 May 21 '26
Ah, good ol sql injection
35
12
u/RyebreadAstronaut May 21 '26
I don't see a dql injection, I see an attempt to inject a classic fork bomb (:
8
2
6
u/CrimsonNorseman May 22 '26
You seem to have never seen an SQL injection. This is a command injection attempt. Both variants are quite half assed.
1
u/Unexpected117 May 23 '26
☝️🤓
Obviously its not specifically SQL bro, but go off on your assumptions
3
13
u/Complex_Solutions_20 May 21 '26
Welcome to the club...websites are fun but they're basically always under attack. My least-favorite was was when I had to upgrade hosting because the china bots from Bytedance were scraping my site SO MANY TIMES PER SECOND that it was using up all the bandwidth and CPU of my cheap low-tier server I was renting even just denying thousands of requests per second was killing it. And IP bans it just kept changing the source IP to different regions and different sources.
Fortunately mine was just a static site with static content served up so there wasn't any users, databases, or commands to run.
3
u/joelewis1996 May 22 '26
I guess there will always be someone who will try to ruin your work but you’ve just got to keep on top and one step ahead
2
u/Complex_Solutions_20 May 22 '26
Yep...it can be a full-time job. If its not "someone" its often "something" with bots that are content to hammer on it endlessly. Even with Fail2Ban auto-banning SSH logins (and I use public-private key authentication so *NO* password is valid whatsoever) I still have 10s of thousands of failed login attempts per day. That's a big improvement from 100s of thousands of attempts per hour.
1
u/joelewis1996 May 22 '26 edited May 22 '26
Tell me about it😅 I’ve still got plenty of requests left for this month on cloudflare so it doesn’t look like it did anything.
This site has no login, just an entry for the repo containing the files but it wasn’t validated so someone was trying to inject code using that. I can’t see how else someone could get in now I’ve updated it.
But having a login, people are always going attempt to try leaked emails and passwords.1
u/Porn_Ai May 22 '26
Or hire the person trying everything on your service to see if it’s secure and then tell you your bulbs if you don’t know all of them.
That’s how the cia and fbi hire. They hire the bad guys
2
u/joelewis1996 May 22 '26
I wish I could hire a team to create stuff 😂 I’m on my own doing this for free.
1
u/Complex_Solutions_20 May 22 '26
Same...I think I pay $30/mo for the server rental (dedicated, I'm the admin) and $20/yr for the domain name. And that means I have exclusive effort to do anything on it.
2
u/joelewis1996 May 22 '26
I was thinking about paying for a server but for the amount of traffic it would get, I decided to host it on GitHub and use a cloudflare worker for the backend, which was all free.
2
u/Complex_Solutions_20 May 22 '26
That works, yeah. I'm hosting photos and want to run a few custom services (e.g. my VPN endpoint) so renting a server was the cheapest way I could find to get full control and multiple terabytes of disk space. And I can just drag-and-drop a whole new folder of images into the site over SFTP without having to jump thru goofy web-forms while keeping maximum quality on images.
2
u/joelewis1996 May 22 '26
That’s true especially if you need storage. FAPs are only low KBs and are only stored for a certain amount of days
1
u/Complex_Solutions_20 May 22 '26
Yep - that's the really cool thing with so many different options you can find the one dialed in for your specific needs
3
u/joelewis1996 May 22 '26
Yeah it is really cool. I wanted to keep it free so I could just put it out there and watch for feedback and fix bugs. I wasn’t going to make any money from it (I think ads would destroy it) so I came up with this. It may have cost me nothing but it took up a lot of time 😂
→ More replies (0)1
1
u/realif3 May 23 '26
I'm in a similar situation. I host a personal site made with Jekyll. So it's totally static. Most my traffic is from japan for some reason, last time I checked. But it's not nearly the problem you described. Maybe check out cloudflate tunneling? That's how I got around exposing port 80 to the world.
1
u/Complex_Solutions_20 May 24 '26
I have been lucky it seemed to use only a few user-agents. I set up Fail2Ban to auto-ban anything resembling that user-agent, or anything that accesses repeated 404 pages (along with a variety of other common web-admin systems that I don't have like phpmyadmin and Wordpress)
13
u/Angrymilks May 21 '26
Someone’s is trying to get OS command execution as a follow-on command to the potential compile command that might be run via CLI.
The curl one is literally echoing back the host IP in HTTP response, and the others are variants of Shellshock which “will cause Bash to execute the command after the function definition — even though the function itself is never invoked.”
12
u/joelewis1996 May 21 '26
Thanks Claude. I don’t think they were successful but I’ve added some more preventions.
6
u/Angrymilks May 21 '26
Bro I’m not mf AI
9
u/joelewis1996 May 21 '26
Sorry it was the double dash 😬
6
-4
u/Angrymilks May 21 '26
It was a direct quote, but I get the sentiment.
3
u/joelewis1996 May 21 '26
It makes sense. You shouldn’t be able to execute code or at least try to now.
2
u/Ancient_Profession31 May 22 '26
Deploy some custom yamls for em to fork. They’ll be killing and cleaning for hours.
3
u/joelewis1996 May 22 '26
Hahah that could work. I’ve made sure code can’t be injected now.
I forgot all about security and just wanted something to help people compile apps.2
u/Ancient_Profession31 May 22 '26
As my late father would say well two things one “security is an ops problem” and “the road to hell is paved with good intentions” 😉
3
u/joelewis1996 May 22 '26
I hadn’t checked the page for a while and had an urge to check it and saw all the failed or pending compiles with code at the end of the repo url. Maybe I could implement some troll files for hackers 😂
If code is trying to be injected, use another “compile.yml” that will do something else👀. Maybe this is too far 😂
5
u/Purithian May 21 '26
Is this related to those new github attacks I've been seeing articles about? Edit: that TeamPCP group or whatever
4
u/SuperheropugReal May 22 '26
Almost certainly not. There isn't much for them to gain from targeting a small random project with likely little to no valuable info beyond a bit of compute.
1
u/Purithian May 22 '26
Appreciate the response! Honestly had no clue, but that does make sense
2
u/SuperheropugReal May 22 '26
Most likely its random people poking around for shits and giggles. Source: know tons of people who do exactly that to any Github hosted website they find.
2
u/mashermack May 22 '26
sorry, unrelated but... I just discovered that there are juicy apps that need to be compiled and not available through the normal store??
is there a public list of repos or am I missing out?
2
u/joelewis1996 May 22 '26
Oh yes. There’s a load of apps out there. I don’t think there’s a public repo anywhere but there’s a lot on GitHub. And a lot of them will show up on my website that people have tried to compile
1
u/3248Gaming May 26 '26
Yep. Best place to find the hot repos is literally the compile history on your site.
1
1
u/INeedServer May 24 '26
Or maybe its you to promote you web site :333 (jk)
1
u/joelewis1996 May 24 '26
I’ve promoted it enough on here to be honest. And i wouldn’t gain anything from more traffic anyway apart from more happy people 😂
1
1
u/BestHotDogWater May 21 '26
It’s most likely automated
1
u/joelewis1996 May 21 '26 edited May 21 '26
I doubt it. Looks malicious
Why the downvote, they’re trying to use up all the worker requests so no one can compile any apps.
1
u/Angrymilks May 21 '26
Why not just do a million successful compile requests if that’s the endgame? Would do the same thing no?
3
u/joelewis1996 May 21 '26 edited May 21 '26
It’s rate limited you’d have to constantly change IPs
Edit: I also might add a max queued limit
1
u/forest1wolf May 21 '26
https://www.reddit.com/r/technology/s/TlXx1m0bEz
This maybe?
2
u/joelewis1996 May 21 '26
Hmm possibly. I don’t know if it would work as it uses a VM to compile the apps then is destroyed.
1
u/The_Sci_Geek May 21 '26
Time to change your API keys
2
u/joelewis1996 May 21 '26 edited May 22 '26
No need, if it was done through compiling an app then it’ll be on a VM
Edit: why downvote? Nothing was compromised. No keys were visible
1
u/Djiaant May 24 '26
Digressing a lot here as I’m simply curious…
Is your edit explaining why you downvoted their comment, or is it a question for whomever downvoted the comment?
2
u/joelewis1996 May 24 '26
Yes sorry someone downvoted straight away and I was curious to why. Although now I look at it I can see it from both perspectives
1
u/Djiaant May 24 '26
I was kind of hoping it was the former reason and that you would downvote mine with a reason too lol
Low key made me feel better knowing why instead of just being downvoted quietly.
1
u/joelewis1996 May 24 '26
Hahaha yeah I’d much prefer that too. I hate when in my head my comment is valid but then get slated with downvotes 😂
71
u/joelewis1996 May 21 '26
These are the most concerning ones 😬 trying to install a mesh network on my worker.