Skip to content

msigley/PHP-HTTP-Tarpit

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

32 Commits
 
 
 
 

Repository files navigation

PHP-HTTP-Tarpit

Confuse and waste bot scanners time. Url rewrite unwanted bot traffic to the la_brea.php file. It is important you use Url rewrites not redirects as most bots ignore location headers.

Based on research done by Chris John Riley. http://github.com/ChrisJohnRiley/

Defense Techinques Implemented

  • Blinding Mode
    • Return 200 Founds for all requests.
    • Outputs random alphanumeric content to client.
      • Special phrases and characters injected into the content.
    • Increases amount of false positives in scanners' results.
  • Ninja Mode
    • Return 404 Not Founds for all requests.
    • Sometimes outputs random content as described above.
    • Increases amount of negatives in scanners' results.
  • HTTP Tarpit
    • Returns a 101, 102, 103, or 401 for all requests.
    • Generates long response wait times to client.
    • Wastes time of scanners.
  • Chained Redirection
    • Returns a 301, 302, or 307 for all requests.
    • Redirects to a randomly generated url many times in succession.
    • Wastes time of scanners.
    • Punishes bad web crawlers for not respecting the robots.txt. Looking at you Baidu.
    • Sometimes ends in Bounceback Redirection (see below).
  • Bounceback Redirection
    • Returns a 301, 302, or 307 for all requests.
    • Redirects request back to requesting ip on common http/https ports.
    • Wastes time of scanners.
    • Could potentially tie up resources on attackers edge node.
  • Random Defense Selection
    • For each request
    • By the minute
      • By the minute is very effective in baiting the bots and by not looking too random or predictable.

Wishlist

  • Robots.txt file emulation to not punish good web crawlers.
    • This is handled better by hosting an actual robots.txt and creating an exemption in the url rewrite to allow access to it.
  • Support for dumping contents of random files in a folder for the Blinding Mode defense.

Wordpress Implementation

I have implemented this tarpit script into a Wordpress security plugin here to help with brute force attacks: https://github.com/msigley/WP-Simple-Security