Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/onionltd/EndGame

EndGame DDoS filter.
https://github.com/onionltd/EndGame

anti-ddos ddos filter nginx onion onion-services tor

Last synced: 4 days ago
JSON representation

EndGame DDoS filter.

Awesome Lists containing this project

README 

        
# EndGame V2 - Onion Service DDOS Prevention Front System



V2 Provided by [Dread](http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/) and [White House Market](http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/d/WhiteHouseMarket).



**Should be used with this [onionbalance](https://github.com/zscole/onionbalance) process for distinct descriptors. Use one onion for everything.**



EndGame is



- a front system designed to protect the core application servers on an onion service in a safe and private way.

- locally complied and locally run (no trusted or middle party).

- a combination of multiple different technologies working together in harmony (listed below).

- FREE FOR ALL TO USE!

- *arguably* magic ㄟ( ▔, ▔ )ㄏ



# Main Features



- Fully scripted and easily deploy-able (for mass scaling!) on blank Debian 10 systems.

- Full featured NGINX LUA script to filter packets and provide a captcha directly using the NGINX layer.

- Rate limiting via Tor's V3 onion service circuit ID system with secondary rate limiting based on a testcookie like system.

- Easy Configuration for both local and remote (over Tor) front systems.

- Easily configurable and change-able to meet an onion service's needs.



It can also:

- Cause you to grow a bigger dick than the asshole DDOSER (true *figurally*, lies *probably*)

- Save you millions of dollars do to DDOSER's downing your site for ransom or for their extorting fees.

- Make it look like you know what the fuck you are doing.



# V2 Updates

V2 EndGame has updates to the broken captcha generation process using a clock facing captcha. It includes extra features like

- updated documentation

- load balanced Tor socks processes for more stable socks_passes

- unix listening instead of ports for performance, stability, and security

- true randomization for captcha and cookie generation

- simple queue system (time based, read below)

- various theme configuration options right on the setup file

- dependency script to get all the dependencies only once. Effectively snapshotting all dependencies preventing future dependency repo exploits in the VERY unlikely case a repo was to get compromised. Paranoia mode.

- bug fixes and various performance tunings



### Notes About Queue System



V2 introduces a queue system which effectively prevents CPU exhaustion from mass get attacks. The clock captcha generation is computationally intensive and specifically vulnerable to this kind of attack. By limiting the amount of connections and amount of captcha tries it greatly reduces the CPU cycles to handle the attack.



In this version there is a simple time on line 110 of the `lua/cap.lua` file which gets checked on line 143. It is recommended to variate this value by attaching a sliding scale time circumstance base on front CPU load. Exponential functions based on the "/proc/stat" value. If you do that, keep the curve private because there is always an "ideal" attack value.

When you set set the time value update the `queue.html` file via a script to rewrite the meta refresh variable.



### Tech Overview



Endgame uses a number of open source projects (and libraries) to work properly.



Projects:

* [NGINX](https://NGINX.org/) - NGINX! A web server *obviously* to provide the packet handling, threading, and proxying.

* [Tor](https://www.torproject.org/) - Tor is free and open-source software for enabling anonymous communication. It's awesome and makes all this possible.

* [Vanguards](https://github.com/mikeperry-tor/vanguards) - A safer onion service circuit building system (to prevent some traffic analysis attacks)

* [STEM](https://stem.torproject.org/) - A python controller for Tor.

* [NYX](https://nyx.torproject.org/) - A command-line monitor for Tor (to easily check the endgame front's Tor process.

* [V3 OnionBalance](https://github.com/asn-d6/onionbalance) - A distributed DNS round-robin like system on Tor to allow load-balancing and elimiate single points of failure.

* [OpenSSL](https://www.openssl.org/) - A dependency for a lot of this projects and libraries.

* [Python3](https://www.python.org/) - A easy to work with programming language we use for background image generation.



NGINX Modules:

* [Socks NGINX](https://github.com/yorkane/socks-NGINX-module) - A NGINX module to allow proxying to Tor onion services directly on the NGINX layer.

* [NAXSI](https://github.com/nbs-system/naxsi) - A high performance web application firewall for NGINX.

* [Headers More](https://github.com/openresty/headers-more-NGINX-module) - A module for better control of headers in NGINX.

* [Echo NGINX](https://github.com/openresty/echo-nginx-module) - A NGINX module which allows shell style commands in the NGINX configuration file.

* [LUA NGINX](https://github.com/openresty/lua-nginx-module) - The power of LUA into NGINX via a module. This allows all the scripting, packet filtering, and captcha functionality EndGame does.

* [NGINX Development Kit](https://github.com/vision5/ngx_devel_kit) - Development Kit for NGINX (dependency)



Libraries:

* [LUAJIT2 NGINX](https://github.com/openresty/luajit2) - Just in time compiler for LUA.

* [LUA Resty String](https://github.com/openresty/lua-resty-string) - String functions for ngx_lua and LUAJIT2

* [LUA Resty Cookie](https://github.com/cloudflare/lua-resty-cookie) - Provides cookie manipulation

* [LUA Resty Session](https://github.com/bungle/lua-resty-session) - Provides session manipulation

* [LUA Resty AES](https://github.com/c64bob/lua-resty-aes/raw/master/lib/resty/aes_functions.lua) - AES Functions file for LUA. Used for shared session cookies.

* [LUA Resty Random](https://github.com/bungle/lua-resty-random) - A *true* random number library for OpenResty.



### Configuration



EndGame requires configuration to work properly.



The main configuration can be found at the top of the `setup.sh` file. It customizes most of the script



There are options. Such as:

* MASTERONION - Your V3 Master OnionBalance Address **WITHOUT http://** (example: dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion)

* TORAUTHPASSWORD - Password which is used for your Tor Control Port Authentication with NGINX. Alphanumeric without spaces (example: passwordIcanremembertyping)

* KEY - Alphanumeric Key for the shared front session key. Random alphanumberic 64 or 128 would do fine. (example: isthis64charactorsalreadyicantbelieveitwowsocoolwaitnotyetohdarn)

* SALT - 8 character salt used with the key. 8 random alphanumeric characters (example: saltsalt)

* SESSION_LENGTH - In seconds the amount of time until cookie timeout. Set it high as you can. (example: 3600 [aka 1 hour])

* HEXCOLOR - HEX color put into the css file to be not purple but your main site's color. Any CSS hex will work. (example: #9b59b6)

* SITENAME -  Site name automatically put in the captcha html file. (example: dread)

* LOCALPROXY - If true will set proxy_pass url to the PROXYPASSURL and disable load balanced Tor processes. If enabled will take the BACKENDONIONURL and configure load balanced socks_pass. It's highly recommended to proxy locally if possible.

* PROXYPASSURL - The local url used to proxy_pass all good connections. Not used if LOCALPROXY set to false.

* BACKENDONIONURL - The remote onion service endpoint. This onion is not public and should have no rate limiting or filtering on it. Generally the "core" server onion. Not used if LOCALPROXY set to true.



There is also some editing you need to do in the `caphtml_d.lua`, `naxsi_whitelist.rules`, `site.conf`, and `torrc` files.



- `resty/caphtml_d.lua` - Two Base64 Images. The favicon (line 143) and main logo (line 162). You can use [this](https://base64.guru/converter/encode/image/ico) for the favicon and [this](https://base64.guru/converter/encode/image) for the main logo.

- `queue.html` - Two base64 images. Search for