C0nw0nk
commented
4 years ago Okay i have fully tested your script. It work very well
however it is easy to bypass your script.
If you are refering to what you said in number 6 on your list then any Javascript encryption can always be decoded that is why i randomize it is every page refresh would yield a different encryption method it is extremely difficult to be bypassed because they need to know the puzzle question and answer and to reply to it in the required encrypted header strings. All requiring them to see the Authentication page in the first place there is no automated way to get this information and as soon as you change the Javascript puzzle.
This to be exact.
--local JavascriptPuzzleVars = [[22 + 22]] --44
--local JavascriptPuzzleVars_answer = "44" --if this does not equal the equation above you will find access to your site will be blocked make sure you can do maths!?
--Make our Javascript puzzle a little bit more dynamic than the static equation above it will change every 24 hours :) I made this because the static one is pretty poor security compared to this but this can be improved allot though.
--TODO: IMPROVE THIS!
local JavascriptPuzzleVars = [[parseInt("]] .. os.date("%Y%m%d",os.time()-24*60*60) .. [[", 10) + parseInt("]] .. os.date("%d%m%Y",os.time()-24*60*60) ..[[", 10)]] --Javascript output of our two random numbers
local JavascriptPuzzleVars_answer = os.date("%Y%m%d",os.time()-24*60*60) + os.date("%d%m%Y",os.time()-24*60*60) --lua output of our two random numbers
local JavascriptPuzzleVars_answer = math.floor(JavascriptPuzzleVars_answer+0.5) --fix bug removing the 0. decimal on the end of the figure
local JavascriptPuzzleVars_answer = tostring(JavascriptPuzzleVars_answer) --convert the numeric output to a stringIt would break there method it is possible but extremely difficult same as Google Captcha is possible to be bypassed but extremely difficult. Let alone the fact that what the config sets for expire_time means they will have to solve another puzzle in a few hours anyway / days depending on your config setting.
Below i list features you should implement to provide better security.
1. Sensor Mode (Requested Already)
You need to describe what this is because I have no idea what you are talking about with this ?
2. Reverse dns checkup on crawling bots (Google, Yahoo etc..)
The only reason I don't want to be doing Reverse DNS is because when connecting to external sources it can cause slow downs / lag it defeats the purpose of a ddos script if you create an external flaw that can intentionaly slow it down in order to get data / wait for data response.
3. Random Delay in short range (Before javascript puzzle starts)
So rather than the puzzle be solved by the browser as soon as the browser can solve it you want to delay the browser for like another 3 seconds before it solves the puzzle ?
4. Randomize more javascript puzzle
I was asked about this and gave my answer here it is TODO list item but not a urgent one https://github.com/C0nw0nk/Nginx-Lua-Anti-DDoS/issues/31#issuecomment-606768975
5. Cookie validation with session (store session on server)
No. There is no need to store their sessions on the server itself when my session method of salted hashes and browser cookies works fine... And besides that is a terrible thing to do when under attack because 1million requests = 1million sessions to be stored means your server storage gets maxed out with bogus sessions it is a very very bad idea and to easy to exploit.
6. Implement better javascript encryption (current one can be easily decoded)
Going back to this again it is not a urgent thing on my TODO list https://github.com/C0nw0nk/Nginx-Lua-Anti-DDoS/issues/31#issuecomment-606768975
7. SpamHaus integration (Enable/Disable block user that is in spamhaus botnet database)
That goes back to my comment about connecting to external sources it is a bottle neck that can degrade speed and performance when they are slow in answering your query on a IP that is connecting you want that information ASAP when they slow for 500ms your site can't respond for 500ms until you get that answer about is that IP malicious or not.
Optional Features:
1. Implement themes system so people can change interestial page design
Easy enough.
2. Config system, so people will no need to scroll over entire file to make changes
I put the config area at the top of the file so nobody has to scroll down any lower.
3. Partial Module so each module is loaded from other file it will make it easier for future changes.
Could be good maybe to make to add some features that I do not want to be associated with the CORE of this script and have them be dropped on as plugins by users if they need them. https://github.com/openresty/lua-nginx-module#lua-variable-scope
Will see what i can do when it comes to it.
Currently what I have listed here https://github.com/C0nw0nk/Nginx-Lua-Anti-DDoS/issues/29
Are my priority right now everything else is a maybe but if other people do build things in and make a Pull request to the repo I will accept them and that will speed things up in features area currently I am building allot in my spare time through my own needs on my own servers.
Sylvvvia
Okay i have fully tested your script. It work very well however it is easy to bypass your script. Below i list features you should implement to provide better security.
Optional Features: