Useful BitNinja commands

In this article, you can see some of the most useful BitNinja CLI commands and their short descriptions.

IP management

To manage the BitNinja allow, challenge, block list just use the bitninjacli command, then pass the name of the BitNinja list you would like to manage (–greylist /–blacklist /–whitelist) then you need to define what operation would you like to do (–add /–del /–check) then after a = symbol you need to add the IP address.

Examples:

Commands	Result
bitninjacli –whitelist –add = 1.2.3.4	1.2.3.4 is now added to your account level allow list
bitninjacli –greylist –del = 1.2.3.4	1.2.3.4 is no longer challenge listed if it was challenge listed before
bitninjacli –blacklist –check = 1.2.3.4	checks if 1.2.3.4 is block listed

If you would like to check, delist or add multiple IP addresses, you can do that via a bash script.

#!/bin/bash
while read line; do echo $line;
        #bitninjacli --greylist/ --blacklist/ --whitelist --add/ --del/ --check = IPaddress
        #e.g.:
        bitninjacli --greylist --check=$line
done < $1

WAF 2.0 Module

These commands are useful if your domains behind Cloudflare becomes unreachable after you enabled the Trusted Proxy module. After issuing these commands the issue will be resolved.

bitninjacli --module=SslTerminating --reload

You can reload SslTerminating haproxy.cfg, if Bitninja is running.

bitninjacli --module=SslTerminating --regenerate

You can regenerate SslTerminating haproxy.cfg, if Bitninja is running.

netstat -lntp | grep -E ~60300|60301' ; iptables -S -t nat | grep -E 'BN_WAF_REDIR'

You can check whether WAF has bound itself correctly

Malware detection/scanner module

Change FileSystem monitor temporary to AuditdD
bitninjacli --module=MalwareDetection --use-auditd

Change FileSystem monitor temporary to Inotifywait
bitninjacli --module=MalwareDetection --use-inotify

You can manually start the Malware scan on a specific directory.
bitninjacli --module=MalwareScanner --scan=/path/to/dir/

You can manually stop the running malware scan.
bitninjacli--module=MalwareScanner --cancel

You can test the current Monitoring tool (eg. Inotify or AuditD)
Inotify : ps aux | grep inotify
AuditD: auditctl -l

Other useful commands

Check the ipsets: ipset list -n

Check whether an IP is in any of our list: ipset list ”name of the list” | grep 1.2.3.4

Check for the open ports (Port Honeypot) : netstat -lntp | grep bitninja

List all the hosted domains on Apache: httpd -S or apache2 -S depending on the OS running on the server

To install our public SSH key:

This will let us access your server as root, so we can help you fix issues related to BitNinja

1. open the /root/.ssh/authorized_keys file with your preferred text editor.
   If it does not exist, then create this file with the mkdir /root/.ssh/ && touch ~/.ssh/authorized_keys command.
2. Copy our public SSH key as it is and paste it into the file
   In nano you can do that by opening the file nano like this: nano /root/.ssh/authorized_keys copy the code from below, then right-click into the terminal window. Then press ctrl+x, then Y, and then enter.

from="207.180.231.111" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICA47X8ZCRydQFylHzzV7U/kgvlaB51Qa8AlB6aESU4V Support@bitninja-jump:1683728898

3. Save the changes and then exit the text editor.
4. To apply changes to /etc/ssh/sshd_config, you must reload SSH: sudo systemctl reload ssh

IP address from the domain name

Issue the nslookup command and add the domain name as a parameter. Like:

The server’s name from IP address

Issue nslookup command and the IP address that you wish to check as a parameter. Like this: