# aFleX: Bruce Force Attack Protection

**URL:** <https://community.a10networks.com/t/aflex-bruce-force-attack-protection/285>\
**Category:** aFleX\
**Tags:** aflex\
**Created:** [June 19, 2014, 6:51pm UTC](https://community.a10networks.com/t/aflex-bruce-force-attack-protection/285 "2014-06-19T18:51:17Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![dshin](https://avatars.discourse-cdn.com/v4/letter/d/f05b48/32.png) [@dshin](https://community.a10networks.com/u/dshin)\
**Post date:** [June 19, 2014, 6:51pm UTC](https://community.a10networks.com/t/aflex-bruce-force-attack-protection/285/1 "2014-06-19T18:51:17Z")

</div>

Hi A10 vADC Community,

I would like to share to the A10 vADC community a custom aFleX script created by an A10 SE(Jose S.). This aFleX script mitigates and protects the A10 ADC from BruteForce attacks. This is a very useful script and customizable based on parameter preference. I strongly suggest to implement this script in any of your deployments.

Genard

------------ Copy from here------------- when RULE\_INIT { set ::intentosmax 3 set ::holdtime 120 } when HTTP\_REQUEST { set srcip [IP::remote\_addr] if { [table lookup “failedlogins” -notouch $srcip] equals “$::intentosmax” } { HTTP::respond 200 content “Stop hacking!!! [table timeout “failedlogins” -remaining $srcip] seconds” log “Loging blocked for ip:$srcip \> remaining: [table timeout “failedlogins” -remaining $srcip]s” } }

when HTTP\_RESPONSE { if {[HTTP::header exists “Location”]} { if {([HTTP::header “Location”] ends\_with “/welcome.cgi?p=failed”)} { if { [table lookup “failedlogins” $srcip] != “” } { table incr failedlogins $srcip table timeout “failedlogins” $srcip $::holdtime } else { table add failedlogins $srcip 1 $::holdtime } log “Login detected from ip:$srcip Accumulated:[table lookup failedlogins $srcip]\>remaining: [table timeout “failedlogins” -remaining $srcip]s” } } } ------------ Copy to here-------------

You Can adapt it to work with any failure condition, in this case we look for a redirect to “/welcome.cgi?p=failed” …in your case it can be a 403 or any other value within the response.

Just change this “if” condition:

if {([HTTP::header “Location”] ends\_with “/welcome.cgi?p=failed”)}