Fetching cloudflare event log data using nginx can detect geoIP and IP Visitor attack parameters

INTRODUCE

In this lab, I attempted to monitor HTTP requests coming into a server via Cloudflare and logged by Nginx. The main focus of this test was to understand how malicious payloads can appear in server logs and how these logs can be used for security monitoring purposes. The lab was conducted using a Linux server with Nginx as the web server and Cloudflare as a reverse proxy.

TOOLS USED 🧰

• VIRTUAL BOX : to run ubuntu server and can monitor cloudflare logs in real time
• DOCKER : Functions to run the OWASP Juice Shop website with port 3000
• NGINX : to do a reverse proxy change port 3000 to port 80
• (CDN) CLOUDFLARE : Implementing OWASP Juice Store Web using port 80 and also can maintain traffic security

BACKGROUND

Websites connected to Cloudflare continue to receive a wide variety of requests from the internet, ranging from normal user requests to exploit attempts such as:

• Cross Site Scripting (XSS)
• SQL Injection
• Payload Testing
• Reconnaissance
• Malicious request
• and others

Although some requests may be filtered by Cloudflare, this activity is still interesting to analyze through server logs. In this lab, I’ll try to understand how these events appear in Nginx logs and how they can be used for basic security monitoring.

DON’T FORGET TO PREPARE YOUR DOCKER COMPOSE

Install Owasp Juice Store first using Docker Compose. The reason I use Owasp Juice Store is because this website is vulnerable and suitable for learning cyber security, building web infrastructure security projects, and also being able to test the rules in Cloudflare to see if they are running with these vulnerabilities.

nano docker-compose.yml :

version: '3.8'

services:
  juice-store:
    image: bkimminich/juice-shop:latest
    container_name: owasp_juice_store
    restart: always
    ports:
      - "3000:3000"
    # Optional: kamu bisa membatasi penggunaan RAM agar server tidak crash
    # Optional: you can limit RAM usage to prevent the server from crashing.
    deploy:
      resources:
        limits:
          memory: 512M

NGINX CONFIGURATION REVERSE PROXY

This is a bit easier because it changes port 3000 from docker compose to port 80

sudo nano /etc/nginx/sites-available/YourName(OR)Yourdomain :

delete the default nginx because it is so annoying

server {
    listen 80;
    server_name Yourdomain.com;

    location / {
        proxy_pass http://localhost:3000;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwardedy-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        access_log /var/log/nginx/access.log;
        error_log /var/log/nginx/error.log;
    }
}

server {
    listen 80 default_server;
    server_name Yourdomain.my.id;

    access_log /var/log/nginx/cloudflare.log cloudflare_json;

    location / {
        proxy_pass http://localhost:3000;
    }
}

then run nginx, does it run normally?

nginx -t
systemctl restart nginx
systemctl reload nginx

if successful, just enter here, nothing failed

sudo nano /etc/nginx/nginx.conf

events {
        worker_connections 768;
        # multi_accept on;
}

http {

        real_ip_header CF-Connecting-IP;

        set_real_ip_from 173.245.48.0/20;
        set_real_ip_from 103.21.244.0/22;
        set_real_ip_from 103.22.200.0/22;
        set_real_ip_from 103.31.4.0/22;
        set_real_ip_from 141.101.64.0/18;
        set_real_ip_from 108.162.192.0/18;
        set_real_ip_from 190.93.240.0/20;
        set_real_ip_from 188.114.96.0/20;
        set_real_ip_from 197.234.240.0/22;
        set_real_ip_from 198.41.128.0/17;
        set_real_ip_from 162.158.0.0/15;
        set_real_ip_from 104.16.0.0/13;
        set_real_ip_from 104.24.0.0/14;
        set_real_ip_from 172.64.0.0/13;
        set_real_ip_from 131.0.72.0/22;

        <<!----- Custom Log Format JSON -----!>

        log_format cloudflare_json escape=json
        '{'
        '"time":"$time_iso8601",'
        '"remote_addr":"$remote_addr",'
        '"host":"$host",'
        '"request":"$request",'
        '"status":"$status",'
        '"body_bytes_sent":"$body_bytes_sent",'
        '"http_referer":"$http_referer",'
        '"http_user_agent":"$http_user_agent",'
        '"cf_connecting_ip":"$http_cf_connecting_ip",'
        '"cf_ray":"$http_cf_ray",'
        '"cf_country":"$http_cf_ipcountry",'
        '"xff":"$http_x_forwarded_for"'
        '}';

Whitelist IP Cloudflare {*https://www.cloudflare.com/ips/*}

then run this

tail -f /var/log/nginx/cloudflare.log

If it doesn’t appear, it means it’s from the permissions

sudo touch /var/log/nginx/cloudflare.log
sudo chown www-data:adm /var/log/nginx/cloudflare.log
sudo chmod 640 /var/log/nginx/cloudflare.log

CLOUDFLARE CONF

The first step is to connect the Cloudflare tunnel to your internal server.

# Add cloudflare gpg key
sudo mkdir -p --mode=0755 /usr/share/keyrings
curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null

# Add this repo to your apt repositories
echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared any main' | sudo tee /etc/apt/sources.list.d/cloudflared.list

# install cloudflared
sudo apt-get update && sudo apt-get install cloudflared

sudo cloudflared service install eyJhIjoiZDE5OWMz__Rahasia_hehe_?

If your internal server is connected to Cloudflare, just enter your IP address with port 80, for example {http://192.168.1.1}

ARCHITECTURAL DIAGRAM

MONITORING LOG NGINX

After a request is sent, Nginx records the activity in the server log. Logging is important because administrators can:

• View suspicious requests
• Identifying attack patterns
• Knowing the payload used by the attacker

RESULTS

but there is a drawback, namely that it cannot detect attacks using

• curl
• sqlmap
• bot
• and others