├── README.md
├── botnet_challenge.lua
├── botnet_verify_otp.lua
└── haproxy.cfg


/README.md:
--------------------------------------------------------------------------------
 1 | # haproxy-botnetchallenge
 2 | 
 3 | Implement a js challenge like haproxy enterprise antibonet.
 4 | 
 5 | It's using a totp token.
 6 | (currently the values are hardcoded in lua files, i need to export them to external variables)
 7 | 
 8 | The js challenge itself is pretty basic, I'm doing a simply ror13 to avoid simply scrapping of html response.
 9 | (you can also obsfucate the js if you want)
10 | 
11 | Ideas are welcome, if somebody have idea to implement a nice dynamic challenge js, like haproxy enterprise antibot !
12 | 
13 | 
14 | 
15 | require lua package:
16 | 
17 | https://github.com/tilkinsc/LuaOTP/
18 | 
19 | https://github.com/aiq/basexx/blob/master/lib/basexx.lua
20 | 
21 | https://github.com/kikito/sha1.lua
22 | 
23 | https://github.com/kennyledet/Algorithm-Implementations/blob/master/ROT13_Cipher/Lua/Yonaba/rot13.lua
24 | 


--------------------------------------------------------------------------------
/botnet_challenge.lua:
--------------------------------------------------------------------------------
  1 | local OTP  = require("otp")
  2 | local TOTP = require("totp")
  3 | local basexx = require("basexx")
  4 | 
  5 | local function botnet_challenge(applet)
  6 | 
  7 |     local clientip = applet.f:src()
  8 |     local useragent =  applet.headers["user-agent"][0]
  9 |     if useragent ~= nil then useragent = "sdfocOSdfjiojicvisdinvc" end
 10 | 
 11 |     local randomkey = "dxcKfdojsdfxvcOsdfvc"
 12 |     local INTERVAL              = 15;
 13 |     local DIGITS                = 10;
 14 |     local BASE32_SECRET = basexx.to_base32( clientip..randomkey..useragent )
 15 |     local DIGEST                = "SHA1";
 16 | 
 17 |     OTP.type = "totp"
 18 |     local tdata = OTP.new(BASE32_SECRET, DIGITS, DIGEST, 30)
 19 |     local token = TOTP.now(tdata)
 20 | 
 21 |     
 22 |     local htmlbegin = [[
 23 |         <meta http-equiv="Content-Type" content="text/html;charset=UTF-8" />
 24 |         <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1" />
 25 |         <title>Waiting for the redirectiron...</title>
 26 |         <style type="text/css">
 27 |             body {background-color: #ffffff; font-family: "Helvetica Neue", Helvetica,Arial,sans-serif;}
 28 |             html, body {width: 100%; height: 100%; margin: 0; padding: 0;}
 29 |             span {color: #878787; font-size: 12pt;  text-align: center;}
 30 |             h1 {color: #878787; font-size: 18pt; text-align: center;}
 31 |             .link {margin-top: 40px;}
 32 |             .sk-circle {margin: 80px auto;width: 100px;height: 100px;position: relative;}
 33 |             .sk-circle .sk-child {width: 100%;height: 100%;position: absolute;left: 0;top: 0;}
 34 |             .sk-circle .sk-child:before {content: '';display: block;margin: 0 auto;width: 15%;height: 15%;background-color: #666666;border-radius: 100%;-webkit-animation: sk-circleBounceDelay 1.2s infinite ease-in-out both;animation: sk-circleBounceDelay 1.2s infinite ease-in-out both;}
 35 |             .sk-circle .sk-circle2 {-webkit-transform: rotate(30deg);-ms-transform: rotate(30deg);transform: rotate(30deg); }
 36 |             .sk-circle .sk-circle3 {-webkit-transform: rotate(60deg);-ms-transform: rotate(60deg);transform: rotate(60deg); }
 37 |             .sk-circle .sk-circle4 {-webkit-transform: rotate(90deg);-ms-transform: rotate(90deg);transform: rotate(90deg); }
 38 |             .sk-circle .sk-circle5 {-webkit-transform: rotate(120deg);-ms-transform: rotate(120deg);transform: rotate(120deg); }
 39 |             .sk-circle .sk-circle6 {-webkit-transform: rotate(150deg);-ms-transform: rotate(150deg);transform: rotate(150deg); }
 40 |             .sk-circle .sk-circle7 {-webkit-transform: rotate(180deg);-ms-transform: rotate(180deg);transform: rotate(180deg); }
 41 |             .sk-circle .sk-circle8 {-webkit-transform: rotate(210deg);-ms-transform: rotate(210deg);transform: rotate(210deg); }
 42 |             .sk-circle .sk-circle9 {-webkit-transform: rotate(240deg);-ms-transform: rotate(240deg);transform: rotate(240deg); }
 43 |             .sk-circle .sk-circle10 {-webkit-transform: rotate(270deg);-ms-transform: rotate(270deg);transform: rotate(270deg); }
 44 |             .sk-circle .sk-circle11 {-webkit-transform: rotate(300deg);-ms-transform: rotate(300deg);transform: rotate(300deg); }
 45 |             .sk-circle .sk-circle12 {-webkit-transform: rotate(330deg);-ms-transform: rotate(330deg);transform: rotate(330deg); }
 46 |             .sk-circle .sk-circle2:before {-webkit-animation-delay: -1.1s;animation-delay: -1.1s; }
 47 |             .sk-circle .sk-circle3:before {-webkit-animation-delay: -1s;animation-delay: -1s; }
 48 |             .sk-circle .sk-circle4:before {-webkit-animation-delay: -0.9s;animation-delay: -0.9s; }
 49 |             .sk-circle .sk-circle5:before {-webkit-animation-delay: -0.8s;animation-delay: -0.8s; }
 50 |             .sk-circle .sk-circle6:before {-webkit-animation-delay: -0.7s;animation-delay: -0.7s; }
 51 |             .sk-circle .sk-circle7:before {-webkit-animation-delay: -0.6s;animation-delay: -0.6s; }
 52 |             .sk-circle .sk-circle8:before {-webkit-animation-delay: -0.5s;animation-delay: -0.5s; }
 53 |             .sk-circle .sk-circle9:before {-webkit-animation-delay: -0.4s;animation-delay: -0.4s; }
 54 |             .sk-circle .sk-circle10:before {-webkit-animation-delay: -0.3s;animation-delay: -0.3s; }
 55 |             .sk-circle .sk-circle11:before {-webkit-animation-delay: -0.2s;animation-delay: -0.2s; }
 56 |             .sk-circle .sk-circle12:before {-webkit-animation-delay: -0.1s;animation-delay: -0.1s; }
 57 |             @-webkit-keyframes sk-circleBounceDelay {0%, 80%, 100% {-webkit-transform: scale(0);transform: scale(0);}40% {-webkit-transform: scale(1);transform: scale(1);}}
 58 |             @keyframes sk-circleBounceDelay {0%, 80%, 100% {-webkit-transform: scale(0);transform: scale(0);}40% {-webkit-transform: scale(1);transform: scale(1);}}
 59 | 
 60 |         </style>
 61 |         <script type="text/javascript">
 62 | 
 63 | 	 ]]
 64 | 
 65 | 	local javascript = [[
 66 | 
 67 |             function startCountdown() {
 68 |                 setInterval(function () {
 69 |                     var $secondsElement = document.getElementById('seconds');
 70 |                     var seconds = parseInt($secondsElement.innerHTML);
 71 |                     if (seconds > 0) {
 72 |                         seconds--;
 73 |                         $secondsElement.innerHTML = seconds;
 74 |                     }
 75 |                 }, 1000);
 76 |             }
 77 | 
 78 | 	    function rot13(str) {
 79 | 		var input     = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
 80 | 		var output    = 'NOPQRSTUVWXYZABCDEFGHIJKLMnopqrstuvwxyzabcdefghijklm';
 81 | 		var index     = x => input.indexOf(x);
 82 | 		var translate = x => index(x) > -1 ? output[index(x)] : x;
 83 | 		return str.split('').map(translate).join('');
 84 | 	    }
 85 | 
 86 |             function browserIntegrityCheck() {
 87 |                 w = window.innerWidth;
 88 |                 h = window.innerHeight;
 89 |                 arr = [w, h, Math.floor((Math.random() * 9) + 1)];
 90 |                 arr.push(arr[0] * arr[1] * arr[2]);
 91 |                 d = new Date().getTime();
 92 |                 arr = [];
 93 |                 b = navigator.appName;
 94 |                 div1 = document.createElement('div');
 95 |                 div1.style.display = 'none';
 96 |                 div2 = document.createElement('div');
 97 |                 div2.style.display = 'none';
 98 |                 div3 = document.createElement('div');
 99 |                 div3.style.display = 'none';
100 |                 c = document.getElementById('content');
101 |                 c.appendChild(div1);
102 |                 div1.appendChild(div2);
103 |                 div2.appendChild(div3);
104 |                 div1.removeChild(div2);
105 |                 r = genRandString();
106 |                 if (r.search('asd')) {
107 |                     r.replace('asd', 'bsd');
108 |                 }
109 |             }
110 | 
111 |             function genRandString() {
112 |                 var text = "";
113 |                 var possible = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
114 | 
115 |                 for (var i = 0; i < 5; i++)
116 |                     text += possible.charAt(Math.floor(Math.random() * possible.length));
117 | 
118 |                 return text;
119 |             }
120 |             
121 |             (function () {
122 |                 var a = function () {
123 |                     try {
124 |                         return !!window.addEventListener
125 |                     } catch (e) {
126 |                         return !1
127 |                     }
128 |                 },
129 |                         b = function (b, c) {
130 |                             a() ? document.addEventListener("DOMContentLoaded", b, c) : document.attachEvent("onreadystatechange", b)
131 |                         };
132 |                 b(function () {
133 |                     var a = document.getElementById('content').style.display = 'block';
134 | 
135 |                     setTimeout(browserIntegrityCheck(), 0);
136 |                     setTimeout(function() {
137 |                         document.cookie="MyKey="+rot13(n)+"; path=/";
138 |                         location.reload();
139 |                     }, 4000);
140 | 
141 | 
142 |                 }, false);
143 |             })();
144 |     ]]
145 | 
146 |     local htmlend = [[
147 |         </script>
148 |     </head>
149 |     <body>
150 |         <table width="100%" height="100%" cellpadding="20">
151 |             <tr>
152 |                 <td align="center" valign="middle">
153 |                     <div>
154 |                         <noscript>
155 |                         <h1 style="color:#990000;">Please, turn Javascript on in your browser then reload the page.</h1>
156 |                         </noscript>
157 |                         <div id="content" style="display:none">
158 | 
159 |                             <div class="sk-circle">
160 |                                 <div class="sk-circle1 sk-child"></div>
161 |                                 <div class="sk-circle2 sk-child"></div>
162 |                                 <div class="sk-circle3 sk-child"></div>
163 |                                 <div class="sk-circle4 sk-child"></div>
164 |                                 <div class="sk-circle5 sk-child"></div>
165 |                                 <div class="sk-circle6 sk-child"></div>
166 |                                 <div class="sk-circle7 sk-child"></div>
167 |                                 <div class="sk-circle8 sk-child"></div>
168 |                                 <div class="sk-circle9 sk-child"></div>
169 |                                 <div class="sk-circle10 sk-child"></div>
170 |                                 <div class="sk-circle11 sk-child"></div>
171 |                                 <div class="sk-circle12 sk-child"></div>
172 |                             </div>
173 | 
174 |                             <span>This is an automatic process.  Your browser will redirect to your requested content in <span id="seconds">5</span> seconds.</span>
175 |                         </div>
176 |                     </div>
177 |                 </td>
178 | 
179 |             </tr>
180 |         </table>
181 |     </body>]]
182 |     
183 |     local javascriptvar = string.format([[ var n= "%s"; ]],token)
184 | 
185 |     response = htmlbegin .. javascriptvar .. javascript .. htmlend
186 | 
187 |     applet:set_status(200)
188 |     applet:add_header("content-length", string.len(response))
189 |     applet:add_header("content-type", "text/html")
190 |     applet:add_header("Cache-Control", "no-cache, no-store, must-revalidate")
191 |     applet:add_header("Pragma", "no-cache")
192 |     applet:add_header("Expires", "0")
193 | 
194 |     applet:start_response()
195 |     applet:send(response)
196 | end
197 | core.register_service("botnet_challenge", "http", botnet_challenge)
198 | 
199 | 
200 | 


--------------------------------------------------------------------------------
/botnet_verify_otp.lua:
--------------------------------------------------------------------------------
 1 | local OTP  = require 'otp'
 2 | local TOTP = require 'totp'
 3 | local basexx = require 'basexx'
 4 | local rot13 = require 'rot13'
 5 | 
 6 | core.register_fetches("botnet_verify_otp", function(txn, cookie, alreadyauth, useragent)
 7 |     local cookie = txn:get_var(cookie)
 8 |     local alreadyauth = txn:get_var(alreadyauth)
 9 |     local useragent = txn:get_var(useragent)
10 |     local clientip =  txn.f:src()
11 | 
12 |     if alreadyauth ~= nil and alreadyauth == 1 then return true end
13 |     if cookie == nil then return false end
14 | 
15 |     if useragent ~= nil then useragent = "sdfocOSdfjiojicvisdinvc" end
16 | 
17 |     local status, cookiedecode = pcall(rot13.decipher,cookie);
18 |     if status == false then return false end
19 | 
20 |     local randomkey = "dxcKfdojsdfxvcOsdfvc"
21 |     local INTERVAL              = 15;
22 |     local DIGITS                = 10;
23 |     local BASE32_SECRET = basexx.to_base32( clientip..randomkey..useragent )
24 |     local DIGEST                = "SHA1";
25 | 
26 |     OTP.type = "totp"
27 |     local tdata = OTP.new(BASE32_SECRET, DIGITS, DIGEST, 30)
28 |     local tv1 = TOTP.verify(tdata, cookiedecode, os.time(), 0)
29 |     return tv1
30 | end)
31 | 


--------------------------------------------------------------------------------
/haproxy.cfg:
--------------------------------------------------------------------------------
 1 | global
 2 |     maxconn     20000
 3 |     log         127.0.0.1 local0
 4 |     user        haproxy
 5 |     chroot      /usr/share/haproxy
 6 |     pidfile     /run/haproxy.pid
 7 |     stats socket /var/run/haproxy.stat 
 8 | 
 9 |     lua-load /etc/haproxy/botnet_challenge.lua
10 |     lua-load /etc/haproxy/botnet_verify_otp.lua
11 |     daemon
12 | 
13 | 
14 | frontend  main
15 |     bind :80
16 |     mode                 http
17 | 
18 |     acl staticfiles path_end -f /etc/haproxy/map.d/staticfiles.map
19 |     acl ip_greylist src,map_ip(/etc/haproxy/map.d/greylist.map) -m found
20 | 
21 |     stick-table type ip size 1m expire 24h store gpc0,gpc1,gpt0,http_req_rate(10s)
22 |     #track all request but not assets
23 |     http-request track-sc0 src table main if !staticfiles
24 |     #track ip-useragent only if cookie MyKey is sent
25 |     http-request set-header X-Concat %[src]_%[req.fhdr(User-Agent)] if { req.cook(MyKey) -m found }
26 |     http-request track-sc1 req.fhdr(X-Concat) table authcookie if { req.cook(MyKey) -m found }
27 | 
28 |     #verify otp
29 |     http-request set-var(req.authcookie) req.cook(MyKey)
30 |     http-request set-var(req.alreadyauth) sc1_get_gpt0
31 |     http-request set-var(req.useragent) req.fhdr(user-agent)
32 |     acl authok lua.botnet_verify_otp(req.authcookie,req.alreadyauth,req.useragent) -m bool
33 | 
34 |     #flag gpt=1 in authcookie table with ip/useragent as key if auth is ok
35 |     http-request sc-set-gpt0(1) 1 if authok 
36 | 
37 |     #increase gpc1 for each challenge display for greylist
38 |     http-request sc-inc-gpc1(0) if !authok ip_greylist
39 | 
40 |     #display challenge for 10 first requests
41 |     http-request use-service lua.botnet_challenge if !authok ip_greylist { src_get_gpc1(FO) lt 10 }
42 | 
43 |     # tarpit if detected more than 10 challenge display
44 |     use_backend tarpit if { src_get_gpc1(main) gt 10 }
45 | 
46 |     # tarpit if waf have detected more than 10 attack, even if authok
47 |     use_backend tarpit if { src_get_gpc0(main) gt 10 }
48 | 
49 | 
50 |     default_backend app
51 | 
52 | backend authcookie
53 |     stick-table type string len 250 size 1m expire 12h store gpt0
54 | 
55 | 
56 | backend app
57 |     mode        http
58 |     balance     roundrobin
59 |     timeout     connect 5s
60 |     timeout     server  30s
61 |     timeout     queue   30s
62 | 
63 | 
64 | backend honeypot
65 |         mode http
66 |         http-request tarpit
67 | 
68 | 


--------------------------------------------------------------------------------