-
-
Notifications
You must be signed in to change notification settings - Fork 270
/
anti_ddos_challenge.lua
3300 lines (3036 loc) · 122 KB
/
anti_ddos_challenge.lua
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
--[[
Introduction and details :
Copyright Conor McKnight
https://github.com/C0nw0nk/Nginx-Lua-Anti-DDoS
Information :
My name is Conor McKnight I am a developer of Lua, PHP, HTML, Javascript, MySQL, Visual Basics and various other languages over the years.
This script was my soloution to check web traffic comming into webservers to authenticate that the inbound traffic is a legitimate browser and request,
It was to help the main internet structure aswell as every form of webserver that sends traffic by HTTP(S) protect themselves from the DoS / DDoS (Distributed Denial of Service) antics of the internet.
If you have any bugs issues or problems just post a Issue request. https://github.com/C0nw0nk/Nginx-Lua-Anti-DDoS/issues
If you fork or make any changes to improve this or fix problems please do make a pull request for the community who also use this. https://github.com/C0nw0nk/Nginx-Lua-Anti-DDoS/pulls
Disclaimer :
I am not responsible for what you do with this script nor liable.
Contact : (You can also contact me via github)
https://www.facebook.com/C0nw0nk
]]
--[[
Configuration :
]]
--[[
localize all standard Lua and Spring API functions I use for better performance.
]]
local os = os
local string = string
local math = math
local table = table
local tonumber = tonumber
local tostring = tostring
local next = next
--[[
End localization
]]
--[[
Shared memory cache
If you use this make sure you add this to your nginx configuration
http { #inside http block
lua_shared_dict antiddos 10m; #Anti-DDoS shared memory zone
}
]]
--local shared_memory = ngx.shared.antiddos --What ever memory space your server has set / defined for this to use
--[[
This is a password that encrypts our puzzle and cookies unique to your sites and servers you should change this from the default.
]]
local secret = " enigma" --Signature secret key --CHANGE ME FROM DEFAULT!
--[[
Unique id to identify each individual user and machine trying to access your website IP address works well.
ngx.var.http_cf_connecting_ip --If you proxy your traffic through cloudflare use this
ngx.var.http_x_forwarded_for --If your traffic is proxied through another server / service.
ngx.var.remote_addr --Users IP address
ngx.var.binary_remote_addr --Users IP address in binary
ngx.var.http_user_agent --use this to protect Tor servers from DDoS
You can combine multiple if you like. You can do so like this.
local remote_addr = ngx.var.remote_addr .. ngx.var.http_user_agent
remote_addr = "tor" this will mean this script will be functioning for tor users only
remote_addr = "auto" the script will automatically get the clients IP this is the default it is the smartest and most compatible method with every service proxy etc
]]
local remote_addr = "auto" --Default Automatically get the Clients IP address
--[[
How long when a users request is authenticated will they be allowed to browse and access the site until they will see the auth page again.
The time is expressed in seconds.
None : 0 (This would result in every page and request showing the auth before granting access) --DO NOT SET AS 0 I recommend nothing less than 30 seconds.
One minute: 60
One hour: 3600
One day: 86400
One week: 604800
One month: 2628000
One year: 31536000
Ten years: 315360000
]]
local expire_time = 86400 --One day
--[[
The type of javascript based pingback authentication method to use if it should be GET or POST or can switch between both making it as dynamic as possible.
1 = GET
2 = POST
3 = DYNAMIC
]]
local javascript_REQUEST_TYPE = 2 --Default 2
--[[
Timer to refresh auth page
Time is in seconds only.
]]
local refresh_auth = 5
--[[
Javascript variable checks
These custom javascript checks are to prevent our authentication javascript puzzle / question being solved by the browser if the browser is a fake ghost browser / bot etc.
Only if the web browser does not trigger any of these or does not match conditions defined will the browser solve the authentication request.
]]
local JavascriptVars_opening = [[
if(!window._phantom || !window.callPhantom){/*phantomjs*/
if(!window.__phantomas){/*phantomas PhantomJS-based web perf metrics + monitoring tool*/
if(!window.Buffer){/*nodejs*/
if(!window.emit){/*couchjs*/
if(!window.spawn){/*rhino*/
if(!window.webdriver){/*selenium*/
if(!window.domAutomation || !window.domAutomationController){/*chromium based automation driver*/
if(!window.document.documentElement.getAttribute("webdriver")){
/*if(navigator.userAgent){*/
if(!/bot|curl|kodi|xbmc|wget|urllib|python|winhttp|httrack|alexa|ia_archiver|facebook|twitter|linkedin|pingdom/i.test(navigator.userAgent)){
/*if(navigator.cookieEnabled){*/
/*if(document.cookie.match(/^(?:.*;)?\s*[0-9a-f]{32}\s*=\s*([^;]+)(?:.*)?$/)){*//*HttpOnly Cookie flags prevent this*/
]]
--[[
Javascript variable blacklist
]]
local JavascriptVars_closing = [[
/*}*/
/*}*/
}
/*}*/
}
}
}
}
}
}
}
}
]]
--[[
Javascript Puzzle for web browser to solve do not touch this unless you understand Javascript, HTML and Lua
]]
--Simple static Javascript puzzle where every request all year round the question and answer would be the same pretty predictable for bots.
--local JavascriptPuzzleVars = [[22 + 22]] --44
--local JavascriptPuzzleVars_answer = "44" --if this does not equal the equation above you will find access to your site will be blocked make sure you can do maths!?
--Make our Javascript puzzle a little bit more dynamic than the static equation above it will change every 24 hours :) I made this because the static one is pretty poor security compared to this but this can be improved allot though.
--TODO: IMPROVE THIS!
local JavascriptPuzzleVars = [[parseInt("]] .. os.date("%Y%m%d",os.time()-24*60*60) .. [[", 10) + parseInt("]] .. os.date("%d%m%Y",os.time()-24*60*60) ..[[", 10)]] --Javascript output of our two random numbers
local JavascriptPuzzleVars_answer = os.date("%Y%m%d",os.time()-24*60*60) + os.date("%d%m%Y",os.time()-24*60*60) --lua output of our two random numbers
local JavascriptPuzzleVars_answer = math.floor(JavascriptPuzzleVars_answer+0.5) --fix bug removing the 0. decimal on the end of the figure
local JavascriptPuzzleVars_answer = tostring(JavascriptPuzzleVars_answer) --convert the numeric output to a string
--[[
X-Auth-Header to be static or Dynamic setting this as dynamic is the best form of security
1 = Static
2 = Dynamic
]]
local x_auth_header = 2 --Default 2
local x_auth_header_name = "x-auth-answer" --the header our server will expect the client to send us with the javascript answer this will change if you set the config as dynamic
--[[
Cookie Anti-DDos names
]]
local challenge = "__uip" --this is the first main unique identification of our cookie name
local cookie_name_start_date = challenge.."_start_date" --our cookie start date name of our firewall
local cookie_name_end_date = challenge.."_end_date" --our cookie end date name of our firewall
local cookie_name_encrypted_start_and_end_date = challenge.."_combination" --our cookie challenge unique id name
--[[
Anti-DDoS Cookies to be Encrypted for better security
1 = Cookie names will be plain text above
2 = Encrypted cookie names unique to each individual client/user
]]
local encrypt_anti_ddos_cookies = 2 --Default 2
--[[
Encrypt/Obfuscate Javascript output to prevent content scrappers and bots decrypting it to try and bypass the browser auth checks. Wouldn't want to make life to easy for them now would I.
0 = Random Encryption Best form of security and default
1 = No encryption / Obfuscation
2 = Base64 Data URI only
3 = Hex encryption
4 = Base64 Javascript Encryption
5 = Conor Mcknight's Javascript Scrambler (Obfuscate Javascript by putting it into vars and shuffling them like a deck of cards)
]]
local encrypt_javascript_output = 0
--[[
IP Address Whitelist
Any IP Addresses specified here will be whitelisted to grant direct access to your site bypassing our firewall checks
you can specify IP's like search engine crawler ip addresses here most search engines are smart enough they do not need to be specified,
Major search engines can execute javascript such as Google, Yandex, Bing, Baidu and such so they can solve the auth page puzzle and index your site same as how companies like Cloudflare, Succuri, BitMitigate etc work and your site is still indexed.
Supports IPv4 and IPv6 addresses aswell as subnet ranges
To find all IP ranges of an ASN use : https://www.enjen.net/asn-blocklist/index.php?asn=16509&type=iplist
]]
local ip_whitelist_remote_addr = "auto" --Automatically get the Clients IP address
local ip_whitelist = {
--"127.0.0.1", --localhost
--"192.168.0.1", --localhost
}
--[[
IP Address Blacklist
To block access to any abusive IP's that you do not want to ever access your website
Supports IPv4 and IPv6 addresses aswell as subnet ranges
To find all IP ranges of an ASN use : https://www.enjen.net/asn-blocklist/index.php?asn=16276&type=iplist
For the worst Botnet ASN IP's see here : https://www.spamhaus.org/statistics/botnet-asn/ You can add their IP addresses. https://www.abuseat.org/public/asninfections.html
]]
local ip_blacklist_remote_addr = "auto" --Automatically get the Clients IP address
local ip_blacklist = {
--"127.0.0.1/30", --localhost
--"192.168.0.1", --localhost
--ASN AS16276 OVH IP ranges Block all OVH Servers
"107.189.64.0/18","91.90.92.0/24","198.245.48.0/20","185.243.16.0/24","217.182.0.0/16","51.79.128.0/17","103.5.12.0/22","198.27.64.0/18","46.105.200.0/24","51.79.0.0/17","2607:5300::/32","144.217.0.0/16","46.244.32.0/20","46.105.201.0/24","46.105.198.0/24","54.39.0.0/16","46.105.203.0/24","51.81.128.0/17","46.105.0.0/16","51.178.0.0/16","167.114.128.0/18","91.90.88.0/24","8.7.244.0/24","139.99.128.0/17","144.2.32.0/19","51.38.0.0/16","91.90.94.0/24","8.33.128.0/21","8.21.41.0/24","216.32.194.0/24","51.89.0.0/16","5.196.0.0/16","195.110.30.0/23","51.195.0.0/16","2001:41d0::/32","91.90.93.0/24","8.29.224.0/24","167.114.192.0/19","8.24.8.0/21","91.90.90.0/24","167.114.0.0/17","91.121.0.0/16","51.91.0.0/16","139.99.0.0/17","178.32.0.0/15","8.26.94.0/24","51.77.0.0/16","91.90.89.0/24","185.228.97.0/24","151.80.0.0/16","213.251.128.0/18","149.56.0.0/16","37.59.0.0/16","213.186.32.0/19","2402:1f00::/32","193.70.0.0/17","142.44.128.0/17","51.161.0.0/17","54.38.0.0/16","185.228.98.0/24","91.90.88.0/21","216.32.220.0/24","92.222.0.0/16","147.135.128.0/17","142.4.192.0/19","5.135.0.0/16","192.95.0.0/18","46.105.202.0/24","185.12.32.0/23","145.239.0.0/16","213.32.0.0/17","37.187.0.0/16","37.60.48.0/21","198.100.144.0/20","149.202.0.0/16","94.23.0.0/16","167.114.224.0/19","193.109.63.0/24","51.254.0.0/15","91.90.91.0/24","216.32.213.0/24","216.32.218.0/24","8.33.96.0/21","5.39.0.0/17","185.228.96.0/24","164.132.0.0/16","158.69.0.0/16","46.105.199.0/24","8.30.208.0/21","54.37.0.0/16","46.105.204.0/24","2402:1f00:8100::/40","87.98.128.0/17","51.68.0.0/16","37.60.56.0/21","8.20.110.0/24","51.83.0.0/16","185.45.160.0/22","216.32.192.0/24","198.50.128.0/17","205.218.49.0/24","216.32.216.0/24","51.75.0.0/16","195.246.232.0/23","91.90.95.0/24","51.81.0.0/17","2402:1f00:8000::/40","23.92.224.0/19","192.240.152.0/21","91.134.0.0/16","92.246.224.0/19","176.31.0.0/16","79.137.0.0/17","193.104.19.0/24","137.74.0.0/16","192.99.0.0/16","198.27.92.0/24","147.135.0.0/17","8.33.136.0/24","2604:2dc0::/32","8.33.137.0/24","188.165.0.0/16","66.70.128.0/17","8.18.172.0/24","185.228.99.0/24","54.36.0.0/16","8.18.128.0/24",
--ASN AS12876 ONLINE S.A.S. IP ranges
"62.4.0.0/19","151.115.0.0/18","51.15.0.0/17","163.172.208.0/20","212.129.0.0/18","2001:bc8::/32","212.83.160.0/19","212.47.224.0/19","2001:bc8:1c00::/38","51.158.128.0/17","163.172.0.0/16","212.83.128.0/19","51.158.0.0/15","195.154.0.0/16","51.15.0.0/16","62.210.0.0/16",
}
--[[
Allow or block all Tor users
1 = Allow
2 = block
]]
local tor = 1 --Allow Tor Users
--[[
Unique ID to identify each individual Tor user who connects to the website
Using their User-Agent as a static variable to latch onto works well.
ngx.var.http_user_agent --Default
]]
local tor_remote_addr = ngx.var.http_user_agent
--[[
X-Tor-Header to be static or Dynamic setting this as dynamic is the best form of security
1 = Static
2 = Dynamic
]]
local x_tor_header = 2 --Default 2
local x_tor_header_name = "x-tor" --tor header name
local x_tor_header_name_allowed = "true" --tor header value when we want to allow access
local x_tor_header_name_blocked = "blocked" --tor header value when we want to block access
--[[
Tor Cookie values
]]
local cookie_tor = challenge.."_tor" --our tor cookie
local cookie_tor_value_allow = "allow" --the value of the cookie when we allow access
local cookie_tor_value_block = "deny" --the value of the cookie when we block access
--[[
TODO:
Google ReCaptcha
]]
--[[
Charset output of HTML page and scripts
]]
local default_charset = "utf-8"
--[[
Enable/disable script this feature allows you to turn on or off this script so you can leave this file in your nginx configuration permamently.
This way you don't have to remove access_by_lua_file anti_ddos_challenge.lua; to stop protecting your websites :) you can set up your nginx config and use this feature to enable or disable protection
1 = enabled (Enabled Anti-DDoS authentication on all sites and paths)
2 = disabled (Won't show anywhere)
3 = custom (Will enable script on sites / URL paths and disable it on those specified)
]]
local master_switch = 1 --enabled by default
--[[
This feature is if you set "master_switch = 3" what this does is if you host multiple websites / services of one server / machine you can have this script disabled for all those websites / domain names other than those you specifiy.
For example you set master_switch to 3 and specifiy ".onion" then all Tor websites you host on your server will be protected by this script while the rest of the websites you host will not be authenticated. (pretty clever huh)
You can also specify full domain names like "github.com" to protect specific domains you can add as many as you like.
1 = run auth checks
2 = bypass auth checks
]]
local master_switch_custom_hosts = {
{
1, --run auth checks
"localhost/ddos.*", --authenticate Tor websites
},
{
1, --run auth checks
".onion/.*", --authenticate Tor websites
},
{
1, --run auth checks
"github.com/.*", --authenticate github
},
--[[
{
1, --run auth checks
"localhost",
}, --authenticate localhost
]]
--[[
{
1, --run auth checks
"127.0.0.1",
}, --authenticate localhost
]]
--[[
{
1, --run auth checks
".com",
}, --authenticate .com domains
]]
}
--[[
Enable/disable credits It would be nice if you would show these to help the community grow and make the internet safer for everyone
but if not I completely understand hence why I made it a option to remove them for you.
1 = enabled
2 = disabled
]]
local credits = 1 --enabled by default
--[[
Javascript variables generated by the script to be static in length or Dynamic setting this as dynamic is the best form of security
1 = Static
2 = Dynamic
]]
local dynamic_javascript_vars_length = 2 --dynamic default
local dynamic_javascript_vars_length_static = 10 --how many chars in length should static be
local dynamic_javascript_vars_length_start = 1 --for dynamic randomize min value to max this is min value
local dynamic_javascript_vars_length_end = 10 --for dynamic randomize min value to max this is max value
--[[
User-Agent Blacklist
If you want to block access to bad bots / specific user-agents you can use this.
1 = case insensative
2 = case sensative
3 = regex case sensative
4 = regex lower case insensative
I added some examples of bad bots to block access to.
]]
local user_agent_blacklist_var = ngx.var.http_user_agent
local user_agent_blacklist_table = {
{
"^$",
3,
}, --blocks blank / empty user-agents
{
"Kodi",
1,
},
{
"XBMC",
1,
},
{
"curl",
1,
},
{
"winhttp",
1,
},
{
"HTTrack",
1,
},
{
"libwww-perl",
1,
},
{
"python",
1,
},
}
--[[
User-Agent Whitelist
If you want to allow access to specific user-agents use this.
1 case insensative
2 case sensative
3 regex case sensative
4 regex lower case insensative
I added some examples of user-agents you could whitelist mostly search engine crawlers.
]]
local user_agent_whitelist_var = ngx.var.http_user_agent
local user_agent_whitelist_table = {
--[[
{
"^Mozilla%/5%.0 %(compatible%; Googlebot%/2%.1%; %+http%:%/%/www%.google%.com%/bot%.html%)$",
2,
},
{
"^Mozilla%/5%.0 %(compatible%; Bingbot%/2%.0%; %+http%:%/%/www%.bing%.com%/bingbot%.htm%)$",
2,
},
{
"^Mozilla%/5%.0 %(compatible%; Yahoo%! Slurp%; http%:%/%/help%.yahoo%.com%/help%/us%/ysearch%/slurp%)$",
2,
},
{
"^DuckDuckBot%/1%.0%; %(%+http%:%/%/duckduckgo%.com%/duckduckbot%.html%)$",
2,
},
{
"^Mozilla%/5%.0 %(compatible%; Baiduspider%/2%.0%; %+http%:%/%/www%.baidu%.com%/search%/spider%.html%)$",
2,
},
{
"^Mozilla%/5%.0 %(compatible%; YandexBot%/3%.0%; %+http%:%/%/yandex%.com%/bots%)$",
2,
},
{
"^facebot$",
2,
},
{
"^facebookexternalhit%/1%.0 %(%+http%:%/%/www%.facebook%.com%/externalhit_uatext%.php%)$",
2,
},
{
"^facebookexternalhit%/1%.1 %(%+http%:%/%/www%.facebook%.com%/externalhit_uatext%.php%)$",
2,
},
{
"^ia_archiver %(%+http%:%/%/www%.alexa%.com%/site%/help%/webmasters%; crawler%@alexa%.com%)$",
2,
},
]]
}
--[[
Authorization Required Box Restricted Access Field
This will NOT use Javascript to authenticate users trying to access your site instead it will use a username and password that can be static or dynamic to grant users access
0 = Disabled
1 = Enabled Browser Sessions (You will see the box again when you restart browser)
2 = Enabled Cookie session (You won't see the box again until the expire_time you set passes)
]]
local authorization = 0
--[[
authorization domains / file paths to protect / restrict access to
1 = Allow showing auth box on matching path(s)
2 = Disallow Showing box matching path(s)
Regex matching file path (.*) will match any
If we should show the client seeing the box what login they can use (Tor websites do this what is why i made this a feature)
0 = Don't display login details
1 = Display login details
]]
local authorization_paths = {
{
1, --show auth box on this path
"localhost/ddos.*", --regex paths i recommend having the domain in there too
1, --display username/password
},
{
1, --show auth box on this path
".onion/administrator.*", --regex paths i recommend having the domain in there too
0, --do NOT display username/password
},
{
1, --show auth box on this path
".com/admin.*", --regex paths i recommend having the domain in there too
0, --do NOT display username/password
},
--[[
{ --Show on All sites and paths
1, --show auth box on this path
".*", --match all sites/domains paths
1, --display username/password
},
]]
}
--[[
Static or Dynamic username and password for Authorization field
0 = Static
1 = Dynamic
]]
local authorization_dynamic = 0 --Static will use list
local authorization_dynamic_length = 5 --max length of our dynamic generated username and password
--[[
Auth box Message
]]
local authorization_message = "Restricted Area " --Message to be displayed with box
local authorization_username_message = "Your username is :" --Message to show username
local authorization_password_message = "Your password is :" --Message to show password
local authorization_logins = { --static password list
{
"userid1", --username
"pass1", --password
},
{
"userid2", --username
"pass2", --password
},
}
--[[
Authorization Box cookie name for sessions
]]
local authorization_cookie = challenge.."_authorization" --our authorization cookie
--[[
WAF Web Application Firewall Filter for Post requests
This feature allows you to intercept incomming client POST data read their POST data and filter out any unwanted code junk etc and block their POST request.
Highly usefull for protecting your web application and backends from attacks zero day exploits and hacking attempts from hackers and bots.
]]
local WAF_POST_Request_table = {
--[[
{
"^task$", --match post data in requests with value task
".*", --matching any
},
{
"^name1$", --regex match
"^.*y$", --regex or exact match
},
]]
}
--[[
WAF Web Application Firewall Filter for Headers in requests
You can use this to block exploits in request headers such as malicious cookies clients try to send
Header exploits in requests they might send such as SQL info to inject into sites highly useful for blocking SQLi and many other attack types
]]
local WAF_Header_Request_table = {
--[[
{
"^foo$", --match header name
".*", --matching any value
},
{
"^user-agent$", --header name
"^.*MJ12Bot.*$", --block a bad bot with user-agent header
},
{
"^cookie$", --Block a Cookie Exploit
".*SNaPjpCNuf9RYfAfiPQgklMGpOY.*",
},
]]
}
--[[
WAF Web Application Firewall Filter for query strings in requests
To block exploits in query strings from potential bots and hackers
]]
local WAF_query_string_Request_table = {
--[[
PHP easter egg exploit blocking
[server with expose_php = on]
.php?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000
.php?=PHPE9568F34-D428-11d2-A769-00AA001ACF42
.php?=PHPE9568F35-D428-11d2-A769-00AA001ACF42
.php?=PHPE9568F36-D428-11d2-A769-00AA001ACF42
]]
{
"^.*$", --match any name
"^PHP.*$", --matching any value
},
{
"base64%_encode", --regex match name
"^.*$", --regex or exact match value
},
{
"base64%_decode", --regex match name
"^.*$", --regex or exact match value
},
--[[
File injection protection
]]
{
"[a-zA-Z0-9_]", --regex match name
"http%:%/%/", --regex or exact match value
},
{
"[a-zA-Z0-9_]", --regex match name
"https%:%/%/", --regex or exact match value
},
--[[
SQLi SQL Injections
]]
{
"^.*$",
"union.*select.*%(",
},
{
"^.*$",
"concat.*%(",
},
{
"^.*$",
"union.*all.*select.*",
},
}
--[[
WAF Web Application Firewall Filter for URL Paths in requests
You can use this to protect server configuration files / paths and sensative material on sites
]]
local WAF_URI_Request_table = {
{
"^.*$", --match any website on server
".*%.htaccess.*", --protect apache server .htaccess files
},
{
"^.*$", --match any website on server
".*config%.php.*", --protect config files
},
{
"^.*$", --match any website on server
".*configuration%.php.*", --protect joomla configuration.php files
},
--[[
Disallow direct access to system directories
]]
{
"^.*$", --match any website on server
".*%/cache.*", --protect /cache folder
},
}
--[[
Caching Speed and Performance
]]
--[[
Enable Query String Sort
This will treat files with the same query strings as the same file, regardless of the order of the query strings.
Example :
Un-Ordered : .com/index.html?lol=1&char=2
Ordered : .com/index.html?char=2&lol=1
This will result in your backend applications and webserver having better performance because of a Higher Cache HIT Ratio.
0 = Disabled
1 = Enabled
]]
local query_string_sort_table = {
{
".*", --regex match any site / path
1, --enable
},
{
"domain.com/.*", --regex match this domain
1, --enable
},
}
--[[
Query String Expected arguments Whitelist only
So this is useful for those who know what URL arguments their sites use and want to whitelist those ONLY so any other arguments provided in the URL never reach the backend or web application and are dropped from the URL.
]]
local query_string_expected_args_only_table = {
--[[
{
".*", --any site
{ --query strings to allow ONLY all others apart from those you list here will be removed from the URL
"punch",
"chickens",
},
},
{
"domain.com", --this domain
{ --query strings to allow ONLY all others apart from those you list here will be removed from the URL
"punch",
"chickens",
},
},
]]
--for all sites specific static files that should never have query strings on the end of the URL (This will improve Caching and performance)
{
"%/.*%.js",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.css",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.ico",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.jpg",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.jpeg",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.bmp",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.gif",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.xml",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.txt",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.png",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.swf",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.pdf",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.zip",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.rar",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.7z",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.woff2",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.woff",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.wof",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.eot",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.ttf",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.svg",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.ejs",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.ps",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.pict",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.webp",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.eps",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.pls",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.csv",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.mid",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.doc",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.ppt",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.tif",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.xls",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.otf",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.jar",
{}, --no args to accept so any provided in the url will be removed.
},
--video file formats
{
"%/.*%.mp4",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.webm",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.ogg",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.flv",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.mov",
{}, --no args to accept so any provided in the url will be removed.
},
--music file formats
{
"%/.*%.mp3",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.m4a",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.aac",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.oga",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.flac",
{}, --no args to accept so any provided in the url will be removed.
},
{
"%/.*%.wav",
{}, --no args to accept so any provided in the url will be removed.
},
}
--[[
Query String Remove arguments
To remove Query strings that bypass the cache Intentionally Facebook and Google is the biggest culprit in this. It is commonly known as Cache Busting.
Traffic to your site from facebook Posts / Shares the URL's will all contain this .com/index.html?fbclid=blah-blah-blah
]]
local query_string_remove_args_table = {
{
".*", --all sites
{ --query strings to remove to improve Cache HIT Ratios and Stop attacks / Cache bypassing and Busting.
--Cloudflare cache busting query strings (get added to url from captcha and javascript pages very naughty breaking sites caches)
"__cf_chl_jschl_tk__",
"__cf_chl_captcha_tk__",
--facebook cache busting query strings
"fb_action_ids",
"fb_action_types",
"fb_source",
"fbclid",
--google cache busting query strings
"_ga",
"gclid",
"utm_source",
"utm_campaign",
"utm_medium",
"utm_expid",
"utm_term",
"utm_content",
--other cache busting query strings
"cache",
"caching",
"age-verified",
"ao_noptimize",
"usqp",
"cn-reloaded",
"dos",
"ddos",
"lol",
"rnd",
"random",
"v", --some urls use ?v1.2 as a file version causing cache busting
"ver",
"version",
},
},
{
"domain.com/.*", --this site
{ --query strings to remove to improve Cache HIT Ratios and Stop attacks / Cache bypassing and Busting.
--facebook cache busting query strings
"fbclid",
},
},
}
--[[
To restore original visitor IP addresses at your origin web server this will send a request header to your backend application or proxy containing the clients real IP address
]]
local send_ip_to_backend_custom_headers = {
{
".*",
{
{"CF-Connecting-IP",}, --CF-Connecting-IP Cloudflare CDN
{"True-Client-IP",}, --True-Client-IP Akamai CDN
{"X-Client-IP",} --Amazon Cloudfront
},
},
--[[
{
"%/.*%.mp4", --custom url paths
{
{"CF-Connecting-IP",}, --CF-Connecting-IP
{"True-Client-IP",}, --True-Client-IP
},
},
]]
}
--[[
Custom headers
To add custom headers to URLs paths to increase server performance and speed to cache items
and to remove headers for security purposes that could expose software the server is running etc
]]
local custom_headers = {
{
".*",
{ --headers to improve server security for all websites
{"Server",nil,}, --Server version / identity exposure remove
{"X-Powered-By",nil,}, --PHP Powered by version / identity exposure remove
{"X-Content-Encoded-By",nil,}, --Joomla Content encoded by remove
{"X-Content-Type-Options","nosniff",}, --block MIME-type sniffing
{"X-XSS-Protection","1; mode=block",}, --block cross-site scripting (XSS) attacks
{"x-turbo-charged-by",nil,}, --remove x-turbo-charged-by LiteSpeed
},
},
{
"%/.*%.js",
{
{"Cache-Control","max-age=315360000, stale-while-revalidate=315360000, stale-if-error=315360000, public, immutable",}, --cache headers to save server bandwidth.
{"Pragma","public",},
},
},
{
"%/.*%.css",
{
{"Cache-Control","max-age=315360000, stale-while-revalidate=315360000, stale-if-error=315360000, public, immutable",}, --cache headers to save server bandwidth.
{"Pragma","public",},
},
},
{
"%/.*%.ico",
{
{"Cache-Control","max-age=315360000, stale-while-revalidate=315360000, stale-if-error=315360000, public, immutable",}, --cache headers to save server bandwidth.
{"Pragma","public",},
},
},
{
"%/.*%.jpg",
{