├── .gitignore
├── LICENSE
├── README.md
├── pom.xml
└── src
└── main
└── java
└── org
└── lambdasec
└── botwall4j
├── CharRequestWrapper.java
├── CharResponseWrapper.java
└── ResponseHardening.java
/.gitignore:
--------------------------------------------------------------------------------
1 | bin/
2 | .classpath
3 | .settings
4 | .project
5 | target
6 | .DS_Store
7 | dependency-reduced-pom.xml
8 | *.jar
9 | *.sig
10 | *.apk
11 | .class
12 | .idea/
13 | *.iml
14 |
--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
1 | Apache License
2 | Version 2.0, January 2004
3 | http://www.apache.org/licenses/
4 |
5 | TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
6 |
7 | 1. Definitions.
8 |
9 | "License" shall mean the terms and conditions for use, reproduction,
10 | and distribution as defined by Sections 1 through 9 of this document.
11 |
12 | "Licensor" shall mean the copyright owner or entity authorized by
13 | the copyright owner that is granting the License.
14 |
15 | "Legal Entity" shall mean the union of the acting entity and all
16 | other entities that control, are controlled by, or are under common
17 | control with that entity. For the purposes of this definition,
18 | "control" means (i) the power, direct or indirect, to cause the
19 | direction or management of such entity, whether by contract or
20 | otherwise, or (ii) ownership of fifty percent (50%) or more of the
21 | outstanding shares, or (iii) beneficial ownership of such entity.
22 |
23 | "You" (or "Your") shall mean an individual or Legal Entity
24 | exercising permissions granted by this License.
25 |
26 | "Source" form shall mean the preferred form for making modifications,
27 | including but not limited to software source code, documentation
28 | source, and configuration files.
29 |
30 | "Object" form shall mean any form resulting from mechanical
31 | transformation or translation of a Source form, including but
32 | not limited to compiled object code, generated documentation,
33 | and conversions to other media types.
34 |
35 | "Work" shall mean the work of authorship, whether in Source or
36 | Object form, made available under the License, as indicated by a
37 | copyright notice that is included in or attached to the work
38 | (an example is provided in the Appendix below).
39 |
40 | "Derivative Works" shall mean any work, whether in Source or Object
41 | form, that is based on (or derived from) the Work and for which the
42 | editorial revisions, annotations, elaborations, or other modifications
43 | represent, as a whole, an original work of authorship. For the purposes
44 | of this License, Derivative Works shall not include works that remain
45 | separable from, or merely link (or bind by name) to the interfaces of,
46 | the Work and Derivative Works thereof.
47 |
48 | "Contribution" shall mean any work of authorship, including
49 | the original version of the Work and any modifications or additions
50 | to that Work or Derivative Works thereof, that is intentionally
51 | submitted to Licensor for inclusion in the Work by the copyright owner
52 | or by an individual or Legal Entity authorized to submit on behalf of
53 | the copyright owner. For the purposes of this definition, "submitted"
54 | means any form of electronic, verbal, or written communication sent
55 | to the Licensor or its representatives, including but not limited to
56 | communication on electronic mailing lists, source code control systems,
57 | and issue tracking systems that are managed by, or on behalf of, the
58 | Licensor for the purpose of discussing and improving the Work, but
59 | excluding communication that is conspicuously marked or otherwise
60 | designated in writing by the copyright owner as "Not a Contribution."
61 |
62 | "Contributor" shall mean Licensor and any individual or Legal Entity
63 | on behalf of whom a Contribution has been received by Licensor and
64 | subsequently incorporated within the Work.
65 |
66 | 2. Grant of Copyright License. Subject to the terms and conditions of
67 | this License, each Contributor hereby grants to You a perpetual,
68 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable
69 | copyright license to reproduce, prepare Derivative Works of,
70 | publicly display, publicly perform, sublicense, and distribute the
71 | Work and such Derivative Works in Source or Object form.
72 |
73 | 3. Grant of Patent License. Subject to the terms and conditions of
74 | this License, each Contributor hereby grants to You a perpetual,
75 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable
76 | (except as stated in this section) patent license to make, have made,
77 | use, offer to sell, sell, import, and otherwise transfer the Work,
78 | where such license applies only to those patent claims licensable
79 | by such Contributor that are necessarily infringed by their
80 | Contribution(s) alone or by combination of their Contribution(s)
81 | with the Work to which such Contribution(s) was submitted. If You
82 | institute patent litigation against any entity (including a
83 | cross-claim or counterclaim in a lawsuit) alleging that the Work
84 | or a Contribution incorporated within the Work constitutes direct
85 | or contributory patent infringement, then any patent licenses
86 | granted to You under this License for that Work shall terminate
87 | as of the date such litigation is filed.
88 |
89 | 4. Redistribution. You may reproduce and distribute copies of the
90 | Work or Derivative Works thereof in any medium, with or without
91 | modifications, and in Source or Object form, provided that You
92 | meet the following conditions:
93 |
94 | (a) You must give any other recipients of the Work or
95 | Derivative Works a copy of this License; and
96 |
97 | (b) You must cause any modified files to carry prominent notices
98 | stating that You changed the files; and
99 |
100 | (c) You must retain, in the Source form of any Derivative Works
101 | that You distribute, all copyright, patent, trademark, and
102 | attribution notices from the Source form of the Work,
103 | excluding those notices that do not pertain to any part of
104 | the Derivative Works; and
105 |
106 | (d) If the Work includes a "NOTICE" text file as part of its
107 | distribution, then any Derivative Works that You distribute must
108 | include a readable copy of the attribution notices contained
109 | within such NOTICE file, excluding those notices that do not
110 | pertain to any part of the Derivative Works, in at least one
111 | of the following places: within a NOTICE text file distributed
112 | as part of the Derivative Works; within the Source form or
113 | documentation, if provided along with the Derivative Works; or,
114 | within a display generated by the Derivative Works, if and
115 | wherever such third-party notices normally appear. The contents
116 | of the NOTICE file are for informational purposes only and
117 | do not modify the License. You may add Your own attribution
118 | notices within Derivative Works that You distribute, alongside
119 | or as an addendum to the NOTICE text from the Work, provided
120 | that such additional attribution notices cannot be construed
121 | as modifying the License.
122 |
123 | You may add Your own copyright statement to Your modifications and
124 | may provide additional or different license terms and conditions
125 | for use, reproduction, or distribution of Your modifications, or
126 | for any such Derivative Works as a whole, provided Your use,
127 | reproduction, and distribution of the Work otherwise complies with
128 | the conditions stated in this License.
129 |
130 | 5. Submission of Contributions. Unless You explicitly state otherwise,
131 | any Contribution intentionally submitted for inclusion in the Work
132 | by You to the Licensor shall be under the terms and conditions of
133 | this License, without any additional terms or conditions.
134 | Notwithstanding the above, nothing herein shall supersede or modify
135 | the terms of any separate license agreement you may have executed
136 | with Licensor regarding such Contributions.
137 |
138 | 6. Trademarks. This License does not grant permission to use the trade
139 | names, trademarks, service marks, or product names of the Licensor,
140 | except as required for reasonable and customary use in describing the
141 | origin of the Work and reproducing the content of the NOTICE file.
142 |
143 | 7. Disclaimer of Warranty. Unless required by applicable law or
144 | agreed to in writing, Licensor provides the Work (and each
145 | Contributor provides its Contributions) on an "AS IS" BASIS,
146 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
147 | implied, including, without limitation, any warranties or conditions
148 | of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
149 | PARTICULAR PURPOSE. You are solely responsible for determining the
150 | appropriateness of using or redistributing the Work and assume any
151 | risks associated with Your exercise of permissions under this License.
152 |
153 | 8. Limitation of Liability. In no event and under no legal theory,
154 | whether in tort (including negligence), contract, or otherwise,
155 | unless required by applicable law (such as deliberate and grossly
156 | negligent acts) or agreed to in writing, shall any Contributor be
157 | liable to You for damages, including any direct, indirect, special,
158 | incidental, or consequential damages of any character arising as a
159 | result of this License or out of the use or inability to use the
160 | Work (including but not limited to damages for loss of goodwill,
161 | work stoppage, computer failure or malfunction, or any and all
162 | other commercial damages or losses), even if such Contributor
163 | has been advised of the possibility of such damages.
164 |
165 | 9. Accepting Warranty or Additional Liability. While redistributing
166 | the Work or Derivative Works thereof, You may choose to offer,
167 | and charge a fee for, acceptance of support, warranty, indemnity,
168 | or other liability obligations and/or rights consistent with this
169 | License. However, in accepting such obligations, You may act only
170 | on Your own behalf and on Your sole responsibility, not on behalf
171 | of any other Contributor, and only if You agree to indemnify,
172 | defend, and hold each Contributor harmless for any liability
173 | incurred by, or claims asserted against, such Contributor by reason
174 | of your accepting any such warranty or additional liability.
175 |
176 | END OF TERMS AND CONDITIONS
177 |
178 | APPENDIX: How to apply the Apache License to your work.
179 |
180 | To apply the Apache License to your work, attach the following
181 | boilerplate notice, with the fields enclosed by brackets "{}"
182 | replaced with your own identifying information. (Don't include
183 | the brackets!) The text should be enclosed in the appropriate
184 | comment syntax for the file format. We also recommend that a
185 | file or class name and description of purpose be included on the
186 | same "printed page" as the copyright notice for easier
187 | identification within third-party archives.
188 |
189 | Copyright {yyyy} {name of copyright owner}
190 |
191 | Licensed under the Apache License, Version 2.0 (the "License");
192 | you may not use this file except in compliance with the License.
193 | You may obtain a copy of the License at
194 |
195 | http://www.apache.org/licenses/LICENSE-2.0
196 |
197 | Unless required by applicable law or agreed to in writing, software
198 | distributed under the License is distributed on an "AS IS" BASIS,
199 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
200 | See the License for the specific language governing permissions and
201 | limitations under the License.
202 |
203 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # Botwall4J
2 |
3 | This project implements a `ResponseHardening` servlet filter that acts as a botwall for your Java web applications. The filter transparently rewrites all `input` and `form` elements on your web pages to random values which makes them harder to scrape automatically. You do not need to modify your application.
4 |
5 | ## Instructions
6 |
7 | Make sure that the `botwall4j` jar is available on your classpath. You can then modify the `web.xml` file to include the filter as follows:
8 |
9 | ```
10 |
11 | Botwall4J
12 | org.lambdasec.botwall4j.ResponseHardening
13 |
14 |
15 | Botwall4J
16 | /*
17 |
18 | ```
19 |
20 | For properly functioning of your application this filter should be the first in the filter chain. You can ensure that in the `web.xml` by defining it above all other filters.
21 |
22 | ### Integrate with Spring Boot (using Java config)
23 |
24 | It is also possible to use it without the `web.xml` configuration. For example, in a Spring Boot application you can add the `botwall4j` library to your application and register the filter using the `filterRegistrationBean`:
25 |
26 | ```
27 | @Bean
28 | public FilterRegistrationBean responseHardeningFilterRegistrationBean() {
29 | final FilterRegistrationBean filterRegBean = new FilterRegistrationBean();
30 | filterRegBean.setFilter(new ResponseHardening());
31 | filterRegBean.setEnabled(true);
32 | filterRegBean.setOrder(Integer.MIN_VALUE);
33 | return filterRegBean;
34 | }
35 | ```
36 |
37 | Setting the order to `Integer.MIN_VALUE` will ensure that the filter runs first in the filter chain.
38 |
39 | ## Articles
40 |
41 | - [Protecting Spring Boot Apps with Botwall4J](https://lambdasec.github.io/Protecting-Spring-Boot-Apps-with-Botwall4J/)
42 |
--------------------------------------------------------------------------------
/pom.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 | 4.0.0
4 | org.lambdasec
5 | botwall4j
6 | 0.1-SNAPSHOT
7 | jar
8 |
9 |
10 | javax.servlet
11 | javax.servlet-api
12 | 3.0.1
13 |
14 |
15 | org.jsoup
16 | jsoup
17 | 1.8.3
18 |
19 |
20 | commons-codec
21 | commons-codec
22 | 1.9
23 |
24 |
25 |
26 | UTF-8
27 | 1.8
28 | 1.8
29 |
30 |
31 |
32 |
33 |
34 | org.apache.maven.plugins
35 | maven-release-plugin
36 | 2.5
37 |
38 |
39 | maven-assembly-plugin
40 | 2.4
41 |
42 |
43 | src/main/resources/assembly.xml
44 |
45 |
46 |
47 |
48 | org.apache.maven.plugins
49 | maven-compiler-plugin
50 | 2.3.2
51 |
52 | 1.7
53 | 1.7
54 |
55 |
56 |
57 | org.apache.maven.plugins
58 | maven-javadoc-plugin
59 | 2.9.1
60 |
61 | ${basedir}/src/main/resources/css/javadoc.css
62 |
63 |
64 |
65 |
66 |
67 |
68 | fatjar
69 |
70 |
71 |
72 | org.apache.maven.plugins
73 | maven-shade-plugin
74 | 2.2
75 |
76 |
77 |
78 |
79 |
80 | package
81 |
82 | shade
83 |
84 |
85 |
86 |
87 |
88 |
89 |
90 |
91 |
--------------------------------------------------------------------------------
/src/main/java/org/lambdasec/botwall4j/CharRequestWrapper.java:
--------------------------------------------------------------------------------
1 |
2 | package org.lambdasec.botwall4j;
3 |
4 | import java.io.BufferedReader;
5 | import java.io.ByteArrayInputStream;
6 | import java.io.IOException;
7 | import java.io.InputStreamReader;
8 | import java.io.UnsupportedEncodingException;
9 | import java.net.URLDecoder;
10 | import java.util.*;
11 | import java.util.logging.Level;
12 | import java.util.logging.Logger;
13 | import javax.servlet.ServletException;
14 | import javax.servlet.ServletInputStream;
15 | import javax.servlet.http.HttpServletRequest;
16 | import javax.servlet.http.HttpServletRequestWrapper;
17 |
18 | /**
19 | *
20 | */
21 | public class CharRequestWrapper extends HttpServletRequestWrapper {
22 |
23 | private String newRequestBody;
24 |
25 | private BufferedReader modifiedReader;
26 |
27 | private boolean getInputStreamCalled;
28 |
29 | private boolean getReaderCalled;
30 |
31 | CharRequestWrapper(HttpServletRequest request, Map keyStore) throws ServletException {
32 | super(request);
33 | Map paramMap = request.getParameterMap();
34 | if(paramMap == null) {
35 | StringBuilder sb = new StringBuilder();
36 | try {
37 | BufferedReader reader = request.getReader();
38 | if (reader != null) {
39 | String s;
40 | while ((s = reader.readLine()) != null) {
41 | sb.append(s);
42 | //sb.append('\n'); //if you want the newline
43 | }
44 | }
45 | } catch (IOException ex) {
46 | Logger.getLogger(CharRequestWrapper.class.getName()).log(Level.SEVERE, null, ex);
47 | }
48 | paramMap = getQueryMap(sb.toString());
49 | }
50 | if(!paramMap.isEmpty()) {
51 | StringBuilder newSb = new StringBuilder();
52 | for (String s : paramMap.keySet()) {
53 | for (String param: paramMap.get(s)) {
54 | if(keyStore.containsKey(s)) {
55 | String randomStr = keyStore.get(s);
56 | newSb.append(randomStr);
57 | }
58 | else {
59 | newSb.append(s);
60 | }
61 | newSb.append("=").append(param).append("&");
62 | }
63 | }
64 | newRequestBody = newSb.toString();
65 | }
66 | else newRequestBody = "";
67 | }
68 |
69 | @Override
70 | public ServletInputStream getInputStream() throws IOException {
71 | if (getReaderCalled) {
72 | throw new IllegalStateException("getReader already called");
73 | }
74 |
75 | getInputStreamCalled = true;
76 | final ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(this.newRequestBody.getBytes());
77 |
78 | return new ServletInputStream() {
79 | @Override
80 | public int read() throws IOException {
81 | return byteArrayInputStream.read();
82 | }
83 | };
84 | }
85 |
86 | @Override
87 | public BufferedReader getReader() throws IOException {
88 | if (modifiedReader != null) {
89 | return modifiedReader;
90 | }
91 | if (getInputStreamCalled) {
92 | throw new IllegalStateException("getInputStreamCalled already called");
93 | }
94 | getReaderCalled = true;
95 | modifiedReader = new BufferedReader(new InputStreamReader(this.getInputStream(), this.getRequest().getCharacterEncoding()));
96 | return modifiedReader;
97 | }
98 |
99 | @Override
100 | public String getQueryString() {
101 | return this.newRequestBody;
102 | }
103 |
104 | @Override
105 | public String getParameter(String name) {
106 | Map paramMap = getQueryMap(this.newRequestBody);
107 | String value = null;
108 | if(paramMap.containsKey(name)) {
109 | value = paramMap.get(name)[0];
110 | }
111 | return value;
112 | }
113 |
114 | @Override
115 | public Enumeration getParameterNames() {
116 | Map paramMap = getQueryMap(this.newRequestBody);
117 | return Collections.enumeration(paramMap.keySet());
118 | }
119 |
120 | @Override
121 | public String[] getParameterValues(String name) {
122 | Map paramMap = getQueryMap(this.newRequestBody);
123 | String[] values = paramMap.get(name);
124 | return values;
125 | }
126 |
127 | @Override
128 | public Map getParameterMap() {
129 | return getQueryMap(this.newRequestBody);
130 | }
131 |
132 | private Map getQueryMap(String query)
133 | {
134 | String[] params = query.split("&");
135 | Map map = new HashMap<>();
136 | if(params.length > 0) {
137 | for (String param : params) {
138 | if(param.split("=").length>1) {
139 | String name = param.split("=")[0];
140 | String value = param.split("=")[1];
141 | try {
142 | //String namePath = this.getRequest().getServletContext().getContextPath()+s;
143 | name=URLDecoder.decode(name, "UTF-8");
144 | value=URLDecoder.decode(value, "UTF-8");
145 | } catch (UnsupportedEncodingException ex) {
146 | Logger.getLogger(CharRequestWrapper.class.getName()).log(Level.SEVERE, null, ex);
147 | }
148 | if(map.containsKey(name)) {
149 | List values = Arrays.asList(map.get(name));
150 | values.add(value);
151 | map.remove(name);
152 | map.put(name, (String []) values.toArray());
153 | }
154 | else {
155 | String[] values = new String[1];
156 | values[0] = value;
157 | map.put(name, values);
158 | }
159 | }
160 | }
161 | }
162 | return map;
163 | }
164 |
165 | }
166 |
--------------------------------------------------------------------------------
/src/main/java/org/lambdasec/botwall4j/CharResponseWrapper.java:
--------------------------------------------------------------------------------
1 |
2 | package org.lambdasec.botwall4j;
3 |
4 | import java.io.CharArrayWriter;
5 | import java.io.IOException;
6 | import java.io.PrintWriter;
7 | import java.util.Locale;
8 | import javax.servlet.ServletOutputStream;
9 | import javax.servlet.http.HttpServletResponse;
10 | import javax.servlet.http.HttpServletResponseWrapper;
11 |
12 | /**
13 | *
14 | */
15 | class CharResponseWrapper extends HttpServletResponseWrapper {
16 |
17 | private CharArrayWriter charWriter;
18 |
19 | private PrintWriter writer;
20 |
21 | private boolean getOutputStreamCalled;
22 |
23 | private boolean getWriterCalled;
24 |
25 | CharResponseWrapper(HttpServletResponse response) {
26 | super(response);
27 | charWriter = new CharArrayWriter();
28 | }
29 |
30 | @Override
31 | public ServletOutputStream getOutputStream() throws IOException {
32 | if (getWriterCalled) {
33 | throw new IllegalStateException("getWriter already called");
34 | }
35 |
36 | getOutputStreamCalled = true;
37 | return super.getOutputStream();
38 | }
39 |
40 | @Override
41 | public PrintWriter getWriter() throws IOException {
42 | if (writer != null) {
43 | return writer;
44 | }
45 | if (getOutputStreamCalled) {
46 | throw new IllegalStateException("getOutputStream already called");
47 | }
48 | getWriterCalled = true;
49 | writer = new PrintWriter(charWriter);
50 | return writer;
51 | }
52 |
53 | @Override
54 | public void setStatus(int sc) {
55 | super.setStatus(sc);
56 | }
57 |
58 | @Override
59 | public void setLocale(Locale loc) { super.setLocale(loc); }
60 |
61 | @Override
62 | public void setCharacterEncoding(String charset) { super.setCharacterEncoding(charset); }
63 |
64 | @Override
65 | public void setContentType(String type) { super.setContentType(type); }
66 |
67 | @Override
68 | public String toString() {
69 | String s = null;
70 |
71 | if (writer != null) {
72 | s = charWriter.toString();
73 | }
74 | return s;
75 | }
76 |
77 | }
78 |
--------------------------------------------------------------------------------
/src/main/java/org/lambdasec/botwall4j/ResponseHardening.java:
--------------------------------------------------------------------------------
1 |
2 | package org.lambdasec.botwall4j;
3 |
4 | import java.io.IOException;
5 | import java.util.HashMap;
6 | import java.util.Map;
7 | import java.util.UUID;
8 | import java.util.logging.Level;
9 | import java.util.logging.Logger;
10 | import javax.servlet.Filter;
11 | import javax.servlet.FilterChain;
12 | import javax.servlet.FilterConfig;
13 | import javax.servlet.ServletException;
14 | import javax.servlet.ServletRequest;
15 | import javax.servlet.ServletResponse;
16 | import javax.servlet.http.HttpServletRequest;
17 | import javax.servlet.http.HttpServletResponse;
18 | import javax.servlet.http.HttpSession;
19 | import org.jsoup.Jsoup;
20 | import org.jsoup.nodes.Document;
21 | import org.jsoup.nodes.Element;
22 | import org.jsoup.select.Elements;
23 |
24 | /**
25 | *
26 | */
27 | public class ResponseHardening implements Filter {
28 |
29 | protected FilterConfig config;
30 |
31 | @Override
32 | public void init(FilterConfig fc) throws ServletException {
33 | this.config = fc;
34 | }
35 |
36 | @Override
37 | public void doFilter(ServletRequest request, ServletResponse response, FilterChain fc)
38 | throws IOException, ServletException {
39 | Map keyStore;
40 |
41 | try {
42 | if (request instanceof HttpServletRequest) {
43 | HttpSession st = ((HttpServletRequest) request).getSession();
44 | keyStore = (Map) st.getAttribute("keyStore");
45 | if(keyStore == null) {
46 | keyStore = new HashMap<>();
47 | }
48 | ServletRequest newRequest = new CharRequestWrapper((HttpServletRequest) request, keyStore);
49 | ServletResponse newResponse = new CharResponseWrapper((HttpServletResponse) response);
50 |
51 | fc.doFilter(newRequest, newResponse);
52 |
53 | String html = newResponse.toString();
54 |
55 | if (html != null) {
56 | Document doc = Jsoup.parseBodyFragment(html);
57 | randomize(doc, "input[name]", "name", keyStore, true);
58 | randomize(doc, "input[id]", "id", keyStore, false);
59 | randomize(doc, "form[id]", "id", keyStore, false);
60 | response.getWriter().write(doc.html());
61 | }
62 | st.setAttribute("keyStore", keyStore);
63 | }
64 | }
65 | catch (ServletException se) {
66 | if(response instanceof HttpServletResponse) {
67 | String str = "\n" +
68 | "\n" +
69 | "403 Forbidden\n" +
70 | "\n" +
71 | "