khaleghsalehi / ironfox

Real time and high performance web application layer DDos/Dos/Bot attacks detection and protection.

My current active projects:

AttackIQ

Industrial Firewall, Intrusion Detection & Prevention for ICS/SCADA. (Owned by Safe Instrument)

P.9

Ultimate Solution (%99.9999) for protecting all network traffics against unauthorized access, cryptography attacks and traffic analyzers based on Encryption, Obfuscation and custom RFC

🎁 200,000.0 USD for anyone who can successfully obtain the original traffic (by MITM attack) that has been secured by P.9, click me for more information

ironfox's Issues

explain module

Please explain about each module ?

[nginx-http-footer-filter]
[ngx_http_bot_protection_module]
[ngx_http_captcha_module]
[ngx_http_header_inspect]
[ngx_http_vts]
[ngx_input_validation_module]
[replace-filter-nginx-module]

piece of code!

hi
The detection system adds a piece of code to the server response to prevent duplication and fraud and sends it to the client.
What is that code snippet?

Solve JavaScript code on the client side !!!!

How does the client execute and resolve the JavaScript code it first received from the bot recognition system?

fixed IP and browser

How can a bot be detected if it always requests a fixed IP and browser?

run js chunk

Running Js code is like solving captcha code?
Does the browser run it without user intervention?

bot detection !

These steps can be easily done by a bot !!! (step 1 to 4 )

1- The first request is considered a valid and legal request.
2- In response to the first request, the encrypted token is given to the client (suppose something like JWT)
3- In the second request, the client must resend his/her identity along with the encrypted token
4- If they are the same, the request will be accepted and if they are not the same, the request will be rejected.

decrypt js

Sample JavaScript code to create a fingerprint UUID ?

Nginx not starting after installation

Hi there, wanted to know after the installation and creation of the database, and once I start Innovera service. How can I start nginx?

sadly I still couldn't get it to run:

sadly I still couldn't get it to run:

==========================================
please flow up below command:
please create a user and set password for it by:
bash 1- sudo su - postgres
psql 2- createuser --interactive --pwprompt
psql 3- create databses ironfox;
bash 4- sudo systemctl start innovera
setup done.
root@server:~/ironfox-0.1# sudo su - postgres
postgres@server:~$ createuser --interactive --pwprompt
Enter name of role to add: admin
Enter password for new role: admin
Enter it again: admin
Shall the new role be a superuser? (y/n) y
postgres@server:~$ createdb ironfox;
postgres@server:~$ sudo systemctl start innovera
[sudo] password for postgres: admin
Sorry, try again.
[sudo] password for postgres: admin
sudo: 1 incorrect password attempt

also:
root@server:~/ironfox-0.1# curl http://127.0.0.1:8080
curl: (7) Failed to connect to 127.0.0.1 port 8080: Connection refused

I followed your tutorial accordingly still couldn't get it to run it says password for postgres is wrong even i type the exact same password "admin"
thanks very much

Originally posted by @rohybnol in #1 (comment)

encryption and decryption

What is the method of encryption and decryption?

Whats after ./install.sh

It completed and told me:
Please create a user and set password for it by:
bash 1- sudo su - postgres
psql 2- createuser --interactive --pwprompt
psql 3- create databses ironfox;
bash 4- sudo systemctl start innovera
setup done.

All done properly altough I do not understand where I put my backed IP which is used for protection and how to make it work as when I go to my VPS wherw I installed your script on https://IP nothing happen, I am using the ubuntu version you recommended the only difference I did was to start the installer.sh using bash installer.sh instead of ./installer but that shouldn't be the issue? Thanks man!

How does Anomaly detection work?

How does Anomaly detection work?
Please explain step by step .

302 Redirect

When does a 302 redirect happen?

Detect bot in the first request !

How does it distinguish a bot from a human?
What if the bot is in the first request?