Nginx-Lua-Anti-DDoS

A Anti-DDoS script to protect Nginx web servers using Lua with a HTML Javascript based authentication puzzle inspired by Cloudflare I am under attack mode an Anti-DDoS authentication page protect yourself from every attack type All Layer 7 Attacks Mitigating Historic Attacks DoS DoS Implications DDoS All Brute Force Attacks Zero day exploits Social Engineering Rainbow Tables Password Cracking Tools Password Lists Dictionary Attacks Time Delay Any Hosting Provider Any CMS or Custom Website Unlimited Attempt Frequency Search Attacks HTTP Basic Authentication HTTP Digest Authentication HTML Form Based Authentication Mask Attacks Rule-Based Search Attacks Combinator Attacks Botnet Attacks Unauthorized IPs IP Whitelisting Bruter THC Hydra John the Ripper Brutus Ophcrack unauthorized logins Injection Broken Authentication and Session Management Sensitive Data Exposure XML External Entities (XXE) Broken Access Control Security Misconfiguration Cross-Site Scripting (XSS) Insecure Deserialization Using Components with Known Vulnerabilities Insufficient Logging & Monitoring Drupal WordPress Joomla Flash Magento PHP Plone WHMCS Atlassian Products malicious traffic Adult video script avs KVS Kernel Video Sharing Clip Bucket Tube sites Content Management Systems Social networks scripts backends proxy proxies PHP Python Porn sites xxx adult gaming networks servers sites forums vbulletin phpbb mybb smf simple machines forum xenforo web hosting video streaming buffering ldap upstream downstream download upload rtmp vod video over dl hls dash hds mss livestream drm mp4 mp3 swf css js html php python sex m3u zip rar archive compressed mitigation code source sourcecode chan 4chan 4chan.org 8chan.net 8ch 8ch.net infinite chan 8kun 8kun.net anonymous anon tor services .onion torproject.org nginx.org nginx.com openresty.org darknet dark net deepweb deep web darkweb dark web mirror vpn reddit reddit.com adobe flash hackthissite.org dreamhack hack hacked hacking hacker hackers hackerz hackz hacks code coding script scripting scripter source leaks leaked leaking cve vulnerability great firewall china america japan russia .gov government http1 http2 http3 quic q3 litespeedtech litespeed apache torrents torrent torrenting webtorrent bittorrent bitorrent bit-torrent cyberlocker cyberlockers cyber locker cyberbunker warez keygen key generator free irc internet relay chat peer-to-peer p2p cryptocurrency crypto bitcoin miner browser xmr monero coinhive coin hive coin-hive litecoin ethereum cpu cycles popads pop-ads advert advertisement networks banner ads protect ovh blazingfast.io amazon steampowered valve store.steampowered.com steamcommunity thepiratebay lulzsec antisec xhamster pornhub porn.com pornhub.com xhamster.com xvideos xvdideos.com xnxx xnxx.com popads popcash cpm ppc

1,498

304

1,498

View on GitHub

Top Related Projects

lua-nginx-module

11,702

Embed the Power of Lua into NGINX HTTP servers

ModSecurity

9,273

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis.

naxsi

4,825

NAXSI is an open-source, high performance, low rules maintenance WAF for NGINX

Quick Overview

The C0nw0nk/Nginx-Lua-Anti-DDoS repository is an open-source project that provides a Lua-based anti-DDoS solution for Nginx web servers. It aims to protect websites from various types of DDoS attacks by implementing rate limiting, IP blocking, and other security measures using Nginx's Lua module.

Pros

Easy integration with existing Nginx setups
Customizable rules and thresholds for different types of attacks
Lightweight and efficient, with minimal impact on server performance
Regular updates and community contributions

Cons

Requires Nginx to be compiled with Lua support
May require fine-tuning for optimal performance in specific environments
Limited documentation for advanced configurations
Potential for false positives if not properly configured

Code Examples

Basic rate limiting:

local limit_req = require "resty.limit.req"

local lim, err = limit_req.new("my_limit_req_store", 200, 100)
if not lim then
    ngx.log(ngx.ERR, "failed to instantiate a resty.limit.req object: ", err)
    return ngx.exit(500)
end

local key = ngx.var.binary_remote_addr
local delay, err = lim:incoming(key, true)

if not delay then
    if err == "rejected" then
        return ngx.exit(503)
    end
    ngx.log(ngx.ERR, "failed to limit req: ", err)
    return ngx.exit(500)
end

IP blocking based on user agent:

local bad_ua = ngx.var.http_user_agent
if bad_ua and string.find(bad_ua, "BadBot") then
    ngx.exit(403)
end

CAPTCHA challenge for suspicious requests:

local suspicious_request = check_request_suspicion()
if suspicious_request then
    ngx.header.content_type = "text/html"
    ngx.say([[
        <html>
        <body>
            <h1>CAPTCHA Challenge</h1>
            <form method="POST" action="/verify_captcha">
                <!-- CAPTCHA implementation here -->
                <input type="submit" value="Verify">
            </form>
        </body>
        </html>
    ]])
    ngx.exit(ngx.HTTP_OK)
end

Getting Started

Ensure Nginx is compiled with Lua support

Clone the repository:

git clone https://github.com/C0nw0nk/Nginx-Lua-Anti-DDoS.git

Copy the Lua scripts to your Nginx configuration directory

Include the main script in your Nginx configuration:

http {
    lua_package_path "/path/to/lua/scripts/?.lua;;";
    init_by_lua_file /path/to/lua/scripts/init.lua;
    access_by_lua_file /path/to/lua/scripts/anti_ddos.lua;
}

Restart Nginx and monitor logs for any issues

Competitor Comparisons

lua-nginx-module

11,702

Embed the Power of Lua into NGINX HTTP servers

Pros of lua-nginx-module

More comprehensive and widely adopted solution for extending Nginx with Lua
Actively maintained with frequent updates and a large community
Provides a broader set of features beyond just DDoS protection

Cons of lua-nginx-module

Requires more configuration and setup for specific use cases like DDoS mitigation
May have a steeper learning curve for users focused solely on anti-DDoS functionality
Not specifically optimized for DDoS protection out of the box

Code Comparison

Nginx-Lua-Anti-DDoS:

if ngx.var.remote_addr then
    local success, err = limit_req.limit("zone=one:10r/s")
    if not success then
        return ngx.exit(ngx.HTTP_TOO_MANY_REQUESTS)
    end
end

lua-nginx-module:

local limit_req = require "resty.limit.req"
local lim, err = limit_req.new("my_limit_req_store", 200, 100)
local key = ngx.var.binary_remote_addr
local delay, err = lim:incoming(key, true)
if not delay then
    return ngx.exit(503)
end

Both examples demonstrate rate limiting, but lua-nginx-module offers more flexibility and control over the implementation.

ModSecurity

9,273

Pros of ModSecurity

More comprehensive web application firewall (WAF) with a wide range of security features
Extensive rule set and community-driven rule updates
Cross-platform compatibility (Apache, Nginx, IIS)

Cons of ModSecurity

Higher resource consumption and potential performance impact
Steeper learning curve for configuration and rule management
May require more frequent updates to maintain effectiveness

Code Comparison

ModSecurity (example rule):

SecRule REQUEST_HEADERS:User-Agent "@contains badbot" \
    "id:1000,phase:1,t:lowercase,block,msg:'Bad Bot Detected'"

Nginx-Lua-Anti-DDoS (example code snippet):

if ngx.var.http_user_agent and string.find(string.lower(ngx.var.http_user_agent), "badbot") then
    return ngx.exit(ngx.HTTP_FORBIDDEN)
end

Summary

ModSecurity offers a more comprehensive WAF solution with extensive features and community support, but may have a higher performance impact and complexity. Nginx-Lua-Anti-DDoS provides a lightweight, Lua-based approach specifically for DDoS mitigation in Nginx, offering easier customization but with a narrower focus on anti-DDoS functionality.

naxsi

4,825

NAXSI is an open-source, high performance, low rules maintenance WAF for NGINX

Pros of naxsi

Written in C, offering potentially better performance than Lua-based solutions
Integrated Web Application Firewall (WAF) functionality
Extensive rule set for detecting and blocking various web attacks

Cons of naxsi

More complex setup and configuration compared to Lua-based solutions
Less flexibility for custom modifications without C programming knowledge
May require more frequent updates to maintain effectiveness against new threats

Code Comparison

Naxsi configuration example:

location / {
    SecRulesEnabled;
    DeniedUrl "/RequestDenied";
    CheckRule "$SQL >= 8" BLOCK;
    CheckRule "$RFI >= 8" BLOCK;
    CheckRule "$TRAVERSAL >= 4" BLOCK;
    CheckRule "$EVADE >= 4" BLOCK;
    root /var/www/html;
}

Nginx-Lua-Anti-DDoS configuration example:

http {
    lua_shared_dict flood 10m;
    init_by_lua_file /path/to/anti_ddos.lua;
    access_by_lua_file /path/to/anti_ddos.lua;
}

Both solutions offer DDoS protection for Nginx servers, but they differ in implementation and focus. Naxsi provides a more comprehensive WAF solution with predefined rules, while Nginx-Lua-Anti-DDoS offers a more customizable approach using Lua scripting. The choice between them depends on specific requirements, performance needs, and the level of customization desired.

Convert designs to code with AI

Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.

Try Visual Copilot

README

Master Branch for Modern Nginx Lua Builds - Old Outdated Nginx Lua Builds use this branch

Nginx-Lua-Anti-DDoS

A Anti-DDoS script to protect Nginx web servers using Lua with a Javascript based authentication puzzle inspired by Cloudflare I am under attack mode I built my own Anti-DDoS authentication HTML page puzzle intergrating my Lua, Javascript, HTML and HTTP knowledge.

Mitigate a DDoS attack of any size using my free DDoS protection. Don't get ddos attacked!

If you're under attack and use my script during the attack, visitors will receive an interstitial page for about five seconds while I analyze the traffic to make sure it is a legitimate human visitor.

This can protect you from many different forms of DDoS works with both HTTP and HTTPS / SSL traffic.

No limit on attack size Uptime guarantee

Features :

These are some of the features I built into the script so far.

Security

Limit IP requests / Flooding

Automatically turn on Under Attack mode if DDoS detected

I am Under Attack Mode (DDoS Authentication HTML Page)

IP Address Whitelist

IP Subnet Ranges Whitelist

IP Address Blacklist

IP Subnet Ranges Blacklist

User-Agent Whitelist

User-Agent Blacklist

Protected area / Restricted access field username / password box to restrict access to sites / paths.

Enable or disable logging of users who either fail or succeed solving the authentication puzzle. (Fail2Ban users can use this to ban bots AI tools and IP addresses from the log file)

Range header filtering Most download / Video streaming sites and services use range headers this allows you to filter and block slowhttp / slowloris attack types

WAF (Web Application Firewall)

IPv4 and IPv6 blocking and whitelisting including subnet ranges.

User-Agent blocking and whitelisting to block bad bots and exploits / scanners.

Ability to inspect POST Data / Fields and block malicious POST requests / exploits.

Ability to inspect URL for malicious content SQL/SQI Injections XSS attacks / exploits.

Ability to inspect query strings and arguements for malicious content / exploits.

Ability to inspect all Request Headers provided by the client connecting.

Ability to inspect cookies for exploits.

Caching Speed and Performance

Query String Sorting

Query String Whitelist

Query String Removal (It is a blacklist but it will just drop / remove the argument from the URL not block the request)

Minification / Compression of files removing white space and nulled out code / lines JS JavaScript, CSS Stylesheets, HTML etc

Customization of error pages responses and webpage outputs

Custom error page interception to replace with your own error pages

Hide Web application errors such as PHP errorrs MySQL errors it will intercept them and display a custom error page instead of showing visitors sensative information

Modify webpage outputs to replace contents on pages / files

Information :

If you have any bugs issues or problems just post a Issue request.

https://github.com/C0nw0nk/Nginx-Lua-Anti-DDoS/issues

If you fork or make any changes to improve this or fix problems please do make a pull request for the community who also use this.

https://github.com/C0nw0nk/Nginx-Lua-Anti-DDoS/pulls

Be sure to use the latest Nginx+Lua builds and libraries to avoid any issues.

Usage / Installation :

Edit settings inside anti_ddos_challenge.lua to cater for your own unique needs or improve my work. (Please share your soloutions and additions)

https://github.com/C0nw0nk/Nginx-Lua-Anti-DDoS/blob/master/lua/anti_ddos_challenge.lua

Add this to your Nginx configuration folder.

nginx/conf/lua/

Once installed into your nginx/conf/ folder.

Add this to your HTTP block or it can be in a server or location block depending where you want this script to run for individual locations the entire server or every single website on the server.

lua_shared_dict antiddos 70m; #Anti-DDoS shared memory zone to track requests per each unique user
lua_shared_dict antiddos_blocked 70m; #Anti-DDoS shared memory where blocked users are put
lua_shared_dict ddos_counter 10m; #Anti-DDoS shared memory zone to track total number of blocked users
lua_shared_dict jspuzzle_tracker 70m; #Anti-DDoS shared memory zone monitors each unique ip and number of times they stack up failing to solve the puzzle

access_by_lua_file anti_ddos_challenge.lua;

Example nginx.conf :

This will run for all websites on the nginx server

http {

#shared memory addresses in http block
lua_shared_dict antiddos 70m; #Anti-DDoS shared memory zone to track requests per each unique user
lua_shared_dict antiddos_blocked 70m; #Anti-DDoS shared memory where blocked users are put
lua_shared_dict ddos_counter 10m; #Anti-DDoS shared memory zone to track total number of blocked users
lua_shared_dict jspuzzle_tracker 70m; #Anti-DDoS shared memory zone monitors each unique ip and number of times they stack up failing to solve the puzzle

#nginx config settings etc
access_by_lua_file anti_ddos_challenge.lua;
#more config settings and some server stuff

}

This will make it run for this website only

http {
#shared memory addresses in http block
lua_shared_dict antiddos 70m; #Anti-DDoS shared memory zone to track requests per each unique user
lua_shared_dict antiddos_blocked 70m; #Anti-DDoS shared memory where blocked users are put
lua_shared_dict ddos_counter 10m; #Anti-DDoS shared memory zone to track total number of blocked users
lua_shared_dict jspuzzle_tracker 70m; #Anti-DDoS shared memory zone monitors each unique ip and number of times they stack up failing to solve the puzzle
}

server {
#nginx config settings etc
access_by_lua_file anti_ddos_challenge.lua;
#more config settings and some server stuff
}

This will run in this location block only

http {
#shared memory addresses in http block
lua_shared_dict antiddos 70m; #Anti-DDoS shared memory zone to track requests per each unique user
lua_shared_dict antiddos_blocked 70m; #Anti-DDoS shared memory where blocked users are put
lua_shared_dict ddos_counter 10m; #Anti-DDoS shared memory zone to track total number of blocked users
lua_shared_dict jspuzzle_tracker 70m; #Anti-DDoS shared memory zone monitors each unique ip and number of times they stack up failing to solve the puzzle
}

location / {
#nginx config settings etc
access_by_lua_file anti_ddos_challenge.lua;
#more config settings and some server stuff
}

Other setup options

https://github.com/C0nw0nk/Nginx-Lua-Anti-DDoS/wiki

For setting up the script to run with Tor .onion services, Cloudflares proxy services, Configuration options of the script view the wiki.

Requirements :

NONE! :D You only need Nginx + Lua to use my scripts.

Where can you download Nginx + Lua ?

Openresty provide Nginx + Lua builds for Windows Linux etc here.

https://openresty.org/en/download.html

Nginx4windows has Windows specific builds with Lua here.

http://nginx-win.ecsds.eu/

Or you can download the source code for Nginx here and compile Nginx yourself with Lua.

https://nginx.org/en/download.html

About :

I was inspired to create this because of Cloudflare feature "I'm Under Attack Mode" https://www.cloudflare.com/

There are similar sites and services like BitMitigate but I prefer my own script over their methods.

If you're under attack and have this feature enabled during the attack, visitors will receive an interstitial page for about five seconds while we analyze the traffic to make sure it is a legitimate human visitor.

Advanced DDoS Attack Protection

Unmetered DDoS mitigation to maintain performance and availability

Denial of Service attacks continue to grow in sophistication and force: more distributed, greater volumes of traffic, and encroaching on the application layer.

A successful attack increases unnecessary costs on your infrastructure and IT/security staff. More importantly, it hurts your revenue, customer satisfaction, and brand.

To combat attacks and stay online, youâll need a solution thatâs resilient scalable, and intelligent.

Mitigate a DDoS attack of any size or duration, Don't get ddos attacked!

I love that feature so much ontop of having it enabled on all my Cloudflare proxied sites I decided to make it into a feature on my own servers so the traffic that hits my servers without coming from Cloudflares network is kept in check and authenticated! (Every little helps right!)

Thank you to @Cloudflare for the inspiration and your community for all the love, A big thanks to the @openresty community you guys rock Lua rocks you are all so awesome!

Lets build a better internet together! Where Speed, Privacy, Security and Compression matter!

Here are links to my favorite communities :)

http://openresty.org/en/

https://community.cloudflare.com/

Protected attack types :

All Layer 7 Attacks
Mitigating Historic Attacks
DoS
DoS Implications
DDoS
All Brute Force Attacks
Zero day exploits
Social Engineering
Rainbow Tables
Password Cracking Tools
Password Lists
Dictionary Attacks
Time Delay
Any Hosting Provider
Any CMS or Custom Website
Unlimited Attempt Frequency
Search Attacks
HTTP Basic Authentication
HTTP Digest Authentication
HTML Form Based Authentication
Mask Attacks
Rule-Based Search Attacks
Combinator Attacks
Botnet Attacks
Unauthorized IPs
IP Whitelisting
Bruter
THC Hydra
John the Ripper
Brutus
Ophcrack
unauthorized logins
Injection
Broken Authentication and Session Management
Sensitive Data Exposure
XML External Entities (XXE)
Broken Access Control
Security Misconfiguration
Cross-Site Scripting (XSS)
Insecure Deserialization
Using Components with Known Vulnerabilities
Insufficient Logging & Monitoring
And many othersâ¦

Features :

Advanced DDoS Attack Protection

My script gives you Unmetered DDoS mitigation to maintain performance and availability for free Denial of Service attacks continue to grow in sophistication and force: more distributed, greater volumes of traffic, and encroaching on the application layer. A successful attack increases unnecessary costs on your infrastructure and IT/security staff. More importantly, it hurts your revenue, customer satisfaction, and brand. To combat attacks and stay online, youâll need a solution thatâs resilient scalable, and intelligent.

Common Types of DDoS Attacks

Block Malicious Bot Abuse

Block abusive bots from damaging Internet properties through content scraping, fraudulent checkout, and account takeover.

Prevent Customer Data Breach

Prevent attackers from compromising sensitive customer data, such as user credentials, credit card information, and other personally identifiable information.

Layered Security Defense

layered security approach combines multiple DDoS mitigation capabilities into one service. It prevents disruptions caused by bad traffic, while allowing good traffic through, keeping websites, applications and APIs highly available and performant.

HTTP Flood (Layer 7)

HTTP flood attacks generate high volumes of HTTP, GET, or POST requests from multiple sources, targeting the application layer, causing service degradation or unavailability.

Defend against the largest attacks

Shared Network Intelligence / Collective Intelligence

With every new property, contributor and person using this script your help and contributions to this script makes everyones network safer. You are helping identify and block new and evolving threats across the entire internet back bone / infrastructure.

No Performance Tradeoffs

Eliminate security induced latencies by integrating my script with your servers. You do not need to rely on third party services like Cloudflare, BitMitigate, Sucuri or other such CDN Cloud distributed networks or companies anymore I have given you the tool for free.

Web Application Firewall

enterprise-class web application firewall (WAF) protects your Internet property from common vulnerabilities like SQL injection attacks, cross-site scripting, and cross-site forgery requests and protectects your existing infrastructure.

Rate Limiting

Control to block suspicious visitors

Rate Limiting protects against denial-of-service attacks, brute-force login attempts, and other types of abusive behavior targeting the application layer.

Rate Limiting provides the ability to configure thresholds, define responses, and gain valuable insights into specific URLs of websites, applications, or API endpoints. It adds granular HTTP/HTTPS traffic control. This also reduces bandwidth costs by eliminating unpredictable traffic spikes or attacks.

Protect any Web Application

This script can protect every web application ever built.

Drupal
WordPress
Joomla
Flash
Magento
PHP
Plone
WHMCS
Atlassian Products
Adult video script avs
KVS Kernel Video Sharing
Clip Bucket
Tube sites
Content Management Systems
Social networks
scripts
backends proxy proxies
PHP
Python
Porn sites xxx adult
gaming networks servers sites
forums
vbulletin
phpbb
mybb
smf simple machines forum
xenforo
web hosting
And many more...

Government

Protection for government gateways and websites. With foriegn agencies targeting critical infastructure this will help all government and critical civilian infastructure stay online.

Payment e-comerce content management

If you use Joomla, Drupal, Wordpress, phpbb, mybb, vbulletin popular cms or forum software this will ensure maximum uptime and protection.

Military MoD

Military grade protection for infastructure. MoD military of defence / Armed forces websites. Protecting Police and Army core or law enforcement.

Crypto Currency

This script works well for crypto currency sites due to the nature of wallet controls security and access of crypto based websites it verifys traffic can run javascript and is legitimate before allowing them access protecting sensitive content like wallet access every crypto website that has a swap or dex / cex centralised or decentralised exchange will find this a must have requiremnet for their peer-to-peer marketplace where transactions occur directly between crypto traders.

Tor network / Project .onion :

You can also use this script to protect servers and sites on the Tor network preventing ddos on .onion links. It can help stop attacks on the deepweb / darkweb aswell as on the mainline internet for those who browse your site through the tor browser it makes sure they are legitimate users.

HTTP(S) / HTTP2 / HTTP3 / QUIC :

So with modern internet protocols yes this script does work with all of them! It can protect both encrypted and unencrypted connections and traffic served over TCP aswell as UDP the new method for HTTP3/QUIC connections.

Works with :

Nginx

Nginx + Lua

Openresty

Custom Nginx builds with Lua compiled

Litespeed / Litespeedtech as can be seen here https://openlitespeed.org/kb/openlitespeed-lua-module/ the reason this works with Litespeed Lua is because they use Openresty Lua builds on their server as can be understood here https://openlitespeed.org/kb/openlitespeed-lua-module/#Use

Top Related Projects

Convert designs to code with AI

Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.

Try Visual Copilot