Bravo List
Register
Go Back   > Bravo List > Source Code > Archived Trackers > TBDev
Reply
  #1  
Old 9th February 2020, 12:19
Elena's Avatar
Elena Elena is offline
Senior Member
 
Join Date: Sep 2010
Korea South
Posts: 40
Thumbs up DDOS attack on the site? Put protection!
If the sessions of one and the same the IP (the same) is repeated more than 10 times, clean session for this pest, the IP shall be entered in the table with a note bans - Hacker .
Further bans work at the entrance to the site:
If IP is in the DB site is re-direction to the site ... CIA/FBI or Yandex/Google.
Run the query to the database:
Code:
ALTER TABLE `bans` ADD `haker` enum('yes','no') DEFAULT 'no';
Open the include / functions.php and paste to the end:
Code:
function ipv6_numeric($ip) {
    $binNum = '';
    foreach (unpack('C*', inet_pton($ip)) as $byte) {
        $binNum .= str_pad(decbin($byte), 8, "0", STR_PAD_LEFT);
    }
    return base_convert(ltrim($binNum, '0'), 2, 10);
}
Open index.php and replace what you have on it ( unless of course you do not append anything there! )
Code:
<? require_once("include/bittorrent.php");dbconn(true);header("Content-Type: text/html; charset=cp1251");
if(!$CURUSER){$ip = getip();$nip = ipv6_numeric($ip);
$sess = mysql_query("SELECT * FROM sessions WHERE ip = $nip") or sqlerr(__FILE__, __LINE__);
if (mysql_num_rows($sess) > 10){
mysql_query("INSERT INTO bans (added, addedby, first, last, comment, haker) VALUES (NOW(), 1, $nip, $nip, 'hakker', 'yes')") or sqlerr(__FILE__, __LINE__);
mysql_query("DELETE FROM sessions WHERE ip = $nip") or sqlerr(__FILE__, __LINE__);
print("<html><head><meta http-equiv=refresh content='0;url=https://www.fbi.gov/'></head></html>");}else{
////////////////////////////
$resd = mysql_query("SELECT * FROM bans WHERE $nip >= first AND $nip <= last AND haker = 'no'") or sqlerr(__FILE__, __LINE__);
if (mysql_num_rows($resd) > 0){$comment = mysql_fetch_assoc($resd);$comment = $comment["comment"];?><head><title>MySayt</title>
<meta name="copyright" content="MySayt" /><meta name="description" content="MySayt" /><meta name="keywords" content="MySayt" />
<link rel="shortcut icon" href="https://MySayt/favicon.ico" type="image/x-icon"></head>
<body style="background:black no-repeat center center fixed;-webkit-background-size:cover;-moz-background-size:cover;-o-background-size:cover;background-size:cover;">
<table align="center" width="100%" border="0px">
<td align="center" style="display:yes;position:fixed;margin-top:0px;" width="50%" border="0px">
<div style="display:yes;position:fixed;margin-top:285px;margin-left:470px;border:1px solid #bdbdbd;-moz-border-radius:6px;
border-radius:6px;-webkit-border-radius:6px;align:center;text-align:center;background:#e0e0e0;box-shadow:1px 1px 5px #5d5d5d;
-moz-box-shadow:1px 1px 5px #5d5d5d;-webkit-box-shadow:1px 1px 5px #5d5d5d;">
<table cellpadding="0" cellspacing="0" border="0" width="400px" height="200px"><tr><td align="right" height="5%">
<div style="padding:5px"><br><center><font color=#A52A2A><b>Error</b></font></center></div></td></tr>
<td style="padding-left:4px"><hr></td><tr><td align="left" width="100%" style="padding-left:4px;padding-bottom:2px;text-align:left;">
<div style="padding-left:2px" align="center"><center><font color="red"><b>Your IP is banned on the site!</b></font></center>
<br></div></td></tr></table></div></td></table></body><? die;}else{
$resr = mysql_query("SELECT * FROM bans WHERE $nip >= first AND $nip <= last AND haker = 'yes'") or sqlerr(__FILE__, __LINE__);
if(mysql_num_rows($resr) > 0){print("<html><head><meta http-equiv=refresh content='0;url=https://www.fbi.gov/'></head></html>");}}}
}else{
if(get_user_class() > UC_SYSOP || get_user_class() < UC_USER){
write_log("User ".$CURUSER["username"]." trying to fuck us! Ha-Ha! His IP=".getip()."","white","error");
logoutcookie();mysql_query("update users set enabled='no' where id='".$CURUSER['id']."'");}stdhead();stdfoot();}?>

Last edited by Elena; 9th February 2020 at 14:13.
Reply With Quote
  #2  
Old 9th February 2020, 13:02
DND's Avatar
DND DND is offline
Support
 
Join Date: Dec 2008
Posts: 1,073
Default
Put a condom on it
But how will this work if the attack is on ipv6? From what im seeing the code is only for ipv4
Btw. The easiest way is to simple make a firewall rule directly on the server settings not in the code (most attacks are directly on the server and dont even have an account on the site)
__________________
Need HELP!? I can install:

  1. Server/VPS (Debian,CentOS,Ubuntu,Fedora, FreeBSD) Optimization and ... + Modules
  2. Webserver Windows/Linux (Apache/Lighttpd/Nginx/Mysql/PhpMyAdmin/SSL) Optimization and ... + Modules
  3. Seedbox Windows/Linux (uTorrent,rTorrent,libTorrent,ruTorrent) + Modules
  4. TBDev Support
  5. Gazelle Support Install
  6. TSSE Install Support
Reply With Quote
The Following User Says Thank You to DND For This Useful Post:
papad (9th February 2020)
  #3  
Old 9th February 2020, 13:36
Elena's Avatar
Elena Elena is offline
Senior Member
 
Join Date: Sep 2010
Korea South
Posts: 40
Default
DND
Don’t be dumb, the selection by ip goes in the sessions of the guests, not the users of the site!
Reply With Quote
  #4  
Old 9th February 2020, 13:53
DND's Avatar
DND DND is offline
Support
 
Join Date: Dec 2008
Posts: 1,073
Default
I think you are dumb. It clearly says on your write_log function that a 'username' attacked the site.
If i use 200 servers at the same time to ddos your ip i dont need to login on the site in the first place.. Hence you wont know my 'username a.k.a account' .. lmfao.
Keep fooling yourself that this will help you from ddos attacks.
Every protection needs to be done at server lvl
Whatever...
__________________
Need HELP!? I can install:

  1. Server/VPS (Debian,CentOS,Ubuntu,Fedora, FreeBSD) Optimization and ... + Modules
  2. Webserver Windows/Linux (Apache/Lighttpd/Nginx/Mysql/PhpMyAdmin/SSL) Optimization and ... + Modules
  3. Seedbox Windows/Linux (uTorrent,rTorrent,libTorrent,ruTorrent) + Modules
  4. TBDev Support
  5. Gazelle Support Install
  6. TSSE Install Support
Reply With Quote
  #5  
Old 9th February 2020, 14:11
Elena's Avatar
Elena Elena is offline
Senior Member
 
Join Date: Sep 2010
Korea South
Posts: 40
Default
Quote:
Originally Posted by DND View Post
I think you are dumb. It clearly says on your write_log function that a 'username' attacked the site.
If i use 200 servers at the same time to ddos your ip i dont need to login on the site in the first place.. Hence you wont know my 'username a.k.a account' .. lmfao.
Keep fooling yourself that this will help you from ddos attacks.
Every protection needs to be done at server lvl
Whatever...
You definitely didnít understand the code, did you even read it correctly? What is there and where is it written ???

Added ipv6 function to the code.
Reply With Quote
  #6  
Old 10th February 2020, 01:50
Napon's Avatar
Napon Napon is offline
Senior Member
 
Join Date: Feb 2016
P2P
Posts: 485
Default
Quote:
Originally Posted by DND View Post
I think you are dumb. It clearly says on your write_log function that a 'username' attacked the site.
If i use 200 servers at the same time to ddos your ip i dont need to login on the site in the first place.. Hence you wont know my 'username a.k.a account' .. lmfao.
Keep fooling yourself that this will help you from ddos attacks.
Every protection needs to be done at server lvl
Whatever...
i will go with DND on this too hes not getting it is he DND lol
__________________
https://uploadfiles.io/lgekz
Reply With Quote
  #7  
Old 12th February 2020, 11:32
Elena's Avatar
Elena Elena is offline
Senior Member
 
Join Date: Sep 2010
Korea South
Posts: 40
Default
New look, OTHER! It works, but volunteers are needed to identify errors, if any.
Run the query to the database:
Code:
ALTER TABLE `bans` ADD `haker` enum('yes','no') DEFAULT 'no';
Quote:
replace your files bans.php , the index.php those that attachment.
Open include / functions.php
To find:
Code:
function userlogin($lightmode = false){
...
}
and completely replaced by:
Code:
////////CURUSER function start////////////
function userlogin($lightmode = false){
   global $SITE_ONLINE, $default_language, $tracker_lang, $use_lang;
   unset($GLOBALS["CURUSER"]);
       ////////////////////////
   if (COOKIE_SALT == '' || (COOKIE_SALT == 'default' && $_SERVER['SERVER_ADDR'] != '127.0.0.1' && $_SERVER['SERVER_ADDR'] != $_SERVER['REMOTE_ADDR']))
      die('The script is locked! Change the value of the COOKIE_SALT constant in the include / init.php file to random');
////////////////////////////////
$client  = @$_SERVER['HTTP_CLIENT_IP'];
$forward = @$_SERVER['HTTP_X_FORWARDED_FOR'];
$remote  = @$_SERVER['REMOTE_ADDR'];
if(filter_var($client, FILTER_VALIDATE_IP)) $ip = $client;
elseif(filter_var($forward, FILTER_VALIDATE_IP)) $ip = $forward;
else $ip = $remote;
////////////////////////////////////////////   
   $c_uid = $_COOKIE[COOKIE_UID];
   $c_pass = $_COOKIE[COOKIE_PASSHASH];
   if (!$SITE_ONLINE || empty($c_uid) || empty($c_pass)) {
      if (empty($_COOKIE["lang"]) || !$use_lang)
            include_once('languages/lang_'.$default_language.'/lang_main.php');
    else
       @include_once('languages/lang_'.$_COOKIE["lang"].'/lang_main.php');
      user_session();
      return;
   }
   if (!$CURUSER){
   $id = intval($c_uid);
   if (!$id || strlen($c_pass) != 32) {
      die("Cokie ID invalid or cookie pass hash problem.");
   }
   ////////////////////////////
   $res = mysql_query("SELECT * FROM users WHERE id = $id");// or die(mysql_error());
   $row = mysql_fetch_array($res);
   if (!$row) {
      if (empty($_COOKIE["lang"]) || !$use_lang)
            include_once('languages/lang_'.$default_language.'/lang_main.php');
    else
       @include_once('languages/lang_'.$_COOKIE["lang"].'/lang_main.php');
      user_session();
      return;
   } }
    /////////////////////////
   $subnet = explode('.', getip());
   $subnet[2] = $subnet[3] = 0;
   $subnet = implode('.', $subnet); // 255.255.0.0
   if ($c_pass !== md5($row["passhash"].COOKIE_SALT.$subnet)) {
      if (empty($_COOKIE["lang"]) || !$use_lang)
            include_once('languages/lang_'.$default_language.'/lang_main.php');
    else
       @include_once('languages/lang_'.$_COOKIE["lang"].'/lang_main.php');
      user_session();
      return;
   }   
   /////////////////////////////
   $updateset = array();
    if ($ip != $row['ip']){
if($row["class"] >= 8){
write_log($row["username"]." now logged in with a different IP ".$ip."","d4e605","error");}
   $updateset[] = 'ip = '. sqlesc($ip);}
    if (strtotime($row['last_access']) < (strtotime(get_date_time()) - 300))
        $updateset[] = 'last_access = '.sqlesc(get_date_time());
       //////////////////////////////
    if (count($updateset))
        mysql_query("UPDATE LOW_PRIORITY users SET ".implode(", ", $updateset)." WHERE id=".$row["id"]);// or die(mysql_error());
    $row['ip'] = $ip;
      //////////////////////////////
   if ($row['override_class'] < $row['class'])
      $row['class'] = $row['override_class']; // Override class and save in GLOBAL array below.
       /////////////////////////////////
   $GLOBALS["CURUSER"] = $row;
   if (empty($_COOKIE["lang"]) || !$use_lang)
            include_once('languages/lang_'.$default_language.'/lang_main.php');
    else
       @include_once('languages/lang_'.$_COOKIE["lang"].'/lang_main.php');
//////////////////////////////////
if ($row['enabled'] == 'no'){logoutcookie();}
if (!$lightmode) user_session();}
////////////CURUSER function end///////////////////////
below to find:
Code:
function user_session(){
...
}
and completely replaced by:
Code:
////////////session function start///////////////////////
function user_session(){
   global $CURUSER, $use_sessions;
   if (!$use_sessions)   return;
//////////////////////
$client  = @$_SERVER['HTTP_CLIENT_IP'];
$forward = @$_SERVER['HTTP_X_FORWARDED_FOR'];
$remote  = @$_SERVER['REMOTE_ADDR'];
if(filter_var($client, FILTER_VALIDATE_IP)) $ip = $client;
elseif(filter_var($forward, FILTER_VALIDATE_IP)) $ip = $forward;
else $ip = $remote;
$url = getenv("REQUEST_URI");
///////////////////////////
   if (!$CURUSER){
      $uid = -1;
      $username = '';
      $avatar = '';
      $class = -1;
   } else {
      $uid = $CURUSER['id'];
      $username = $CURUSER['username'];
      $class = $CURUSER['class'];
   } 
/////////////////////
$sess = mysql_query("SELECT COUNT(*) FROM sessions WHERE ip = ".sqlesc($ip));
$sess1 = mysql_fetch_array($sess);$count_sess1 = $sess1[0];if($count_sess1 > 10){
mysql_query("INSERT INTO bans (added, addedby, first, last, comment, haker) VALUES (NOW(), 2, ".sqlesc($ip).", ".sqlesc($ip).", 'hakker', 'yes')") or sqlerr(__FILE__, __LINE__);
mysql_query("DELETE FROM sessions WHERE ip = ".sqlesc($ip)) or sqlerr(__FILE__, __LINE__);
print("<html><head><meta http-equiv=refresh content='0;url=https://www.fbi.gov/'></head></html>");}else{
////////////////////////////
   $sid = session_id();
   $where = array();
   $updateset = array();
   if ($sid)
      $where[] = "sid = ".sqlesc($sid);
   elseif ($uid)
      $where[] = "uid = $uid";
   else
      $where[] = "ip = ".sqlesc($ip);
   /////////////////////
   $ctime = time();
   $agent = $_SERVER["HTTP_USER_AGENT"];
   $updateset[] = "sid = ".sqlesc($sid);
   $updateset[] = "uid = ".sqlesc($uid);
   $updateset[] = "username = ".sqlesc($username);   
   $updateset[] = "class = ".sqlesc($class);
   $updateset[] = "ip = ".sqlesc($ip);
   $updateset[] = "time = ".sqlesc($ctime);
   $updateset[] = "url = ".sqlesc($url);   
   session_write_close();
   if (count($updateset))
      mysql_query("UPDATE sessions SET ".implode(", ", $updateset)." WHERE ".implode(" AND ", $where)) or sqlerr(__FILE__,__LINE__);
   if (mysql_modified_rows() < 1)      
      mysql_query("INSERT INTO sessions (sid, uid, username, class, ip, time, url)
VALUES (".implode(", ", array_map("sqlesc", array($sid, $uid, $username, $class, $ip, $ctime, $url))).")") or sqlerr(__FILE__,__LINE__);}
}
////////////session function end///////////////////////
Open include / functions_global.php
to find:
Code:
function stderr($heading = '', $text = '') {
   stdhead();
   stdmsg($heading, $text, 'error');
   stdfoot();
   die;
}
completely replaced by:
Code:
function stderr($heading = '', $text = ''){
global $CURUSER;
stdhead();?>
<div style="display:yes;position:fixed;margin-top:10px;margin-left:450px;border:1px solid #bdbdbd;-moz-border-radius:6px;border-radius:6px;-webkit-border-radius:6px;align:center;text-align:center;background:#e0e0e0;box-shadow:1px 1px 5px #5d5d5d;-moz-box-shadow:1px 1px 5px #5d5d5d;-webkit-box-shadow:1px 1px 5px #5d5d5d;"> 
<table cellpadding="0" cellspacing="0" border="0" width="400px" height="200px"> 
<tr><td align="right" height="5%"><div style="padding:5px"><br><center><font color=#A52A2A><b><?=$heading?></b></font></center></div></td></tr> 
<td style="padding-left:4px"><hr></td>  <tr><td align="left" width="100%" style="padding-left:4px;padding-bottom:2px;text-align:left;"> 
<div style="padding-left:2px" align="center"><center><?=stdmsg($text)?></center><br></div></td></tr></table></div><?
stdfoot();die;}
Attached Files
File Type: rar bans.rar (1.9 KB, 0 views)
File Type: rar index.rar (659 Bytes, 0 views)
Reply With Quote
The Following User Says Thank You to Elena For This Useful Post:
romano1 (14th February 2020)
  #8  
Old 12th February 2020, 11:59
Napon's Avatar
Napon Napon is offline
Senior Member
 
Join Date: Feb 2016
P2P
Posts: 485
Default
do you think is is going to stop the peeps who is not a member of the site sorry to say no lol...read your own mod only members who are on site lol so how can you ban someone who is not a members lol....so this out of date mod no good

Also there is a ssh mod for this without the bull at top
__________________
https://uploadfiles.io/lgekz
Reply With Quote
  #9  
Old 13th February 2020, 06:34
antimidas's Avatar
antimidas antimidas is offline
Senior Member
 
Join Date: Mar 2011
P2P
Posts: 47
Default
Quote:
Originally Posted by Napon View Post
do you think is is going to stop the peeps who is not a member of the site sorry to say no lol...read your own mod only members who are on site lol so how can you ban someone who is not a members lol....so this out of date mod no good

Also there is a ssh mod for this without the bull at top
Actually have to agree. An addon to your web script that just protects from users is no protection. Here is a bash script.

Code:
#!/bin/sh

#########################################################
#                 ANTI-DDOS BASH SCRIPT                 #
######################################################### 
#                       CONTACT                         #
#########################################################
#              DEVELOPER : İSMAİL TAŞDELEN              #                       
#           GMAIL : ismailtasdelen@protonmail.com       #
# Linkedin : https://www.linkedin.com/in/ismailtasdelen #
#           Telegram : https://t.me/ismailtasdelen      #
#########################################################

# For debugging use iptables -v.
IPTABLES="/sbin/iptables"
IP6TABLES="/sbin/ip6tables"
MODPROBE="/sbin/modprobe"
RMMOD="/sbin/rmmod"
ARP="/usr/sbin/arp"

# Logging options.
#------------------------------------------------------------------------------
LOG="LOG --log-level debug --log-tcp-sequence --log-tcp-options"
LOG="$LOG --log-ip-options"

# Defaults for rate limiting
#------------------------------------------------------------------------------
RLIMIT="-m limit --limit 3/s --limit-burst 8"

# Unprivileged ports.
#------------------------------------------------------------------------------
PHIGH="1024:65535"
PSSH="1000:1023"

# Load required kernel modules
#------------------------------------------------------------------------------
$MODPROBE ip_conntrack_ftp
$MODPROBE ip_conntrack_irc

# Mitigate ARP spoofing/poisoning and similar attacks.
#------------------------------------------------------------------------------
# Hardcode static ARP cache entries here
# $ARP -s IP-ADDRESS MAC-ADDRESS

# Kernel configuration.
#------------------------------------------------------------------------------

# Disable IP forwarding.
# On => Off = (reset)
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 0 > /proc/sys/net/ipv4/ip_forward

# Enable IP spoofing protection
for i in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > $i; done

# Protect against SYN flood attacks
echo 1 > /proc/sys/net/ipv4/tcp_syncookies

# Ignore all incoming ICMP echo requests
echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all

# Ignore ICMP echo requests to broadcast
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Log packets with impossible addresses.
for i in /proc/sys/net/ipv4/conf/*/log_martians; do echo 1 > $i; done

# Don't log invalid responses to broadcast
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

# Don't accept or send ICMP redirects.
for i in /proc/sys/net/ipv4/conf/*/accept_redirects; do echo 0 > $i; done
for i in /proc/sys/net/ipv4/conf/*/send_redirects; do echo 0 > $i; done

# Don't accept source routed packets.
for i in /proc/sys/net/ipv4/conf/*/accept_source_route; do echo 0 > $i; done

# Disable multicast routing
for i in /proc/sys/net/ipv4/conf/*/mc_forwarding; do echo 0 > $i; done

# Disable proxy_arp.
for i in /proc/sys/net/ipv4/conf/*/proxy_arp; do echo 0 > $i; done

# Enable secure redirects, i.e. only accept ICMP redirects for gateways
# Helps against MITM attacks.
for i in /proc/sys/net/ipv4/conf/*/secure_redirects; do echo 1 > $i; done

# Disable bootp_relay
for i in /proc/sys/net/ipv4/conf/*/bootp_relay; do echo 0 > $i; done

# Default policies.
#------------------------------------------------------------------------------

# Drop everything by default.
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -P OUTPUT DROP

# Set the nat/mangle/raw tables' chains to ACCEPT
$IPTABLES -t nat -P PREROUTING ACCEPT
$IPTABLES -t nat -P OUTPUT ACCEPT
$IPTABLES -t nat -P POSTROUTING ACCEPT

$IPTABLES -t mangle -P PREROUTING ACCEPT
$IPTABLES -t mangle -P INPUT ACCEPT
$IPTABLES -t mangle -P FORWARD ACCEPT
$IPTABLES -t mangle -P OUTPUT ACCEPT
$IPTABLES -t mangle -P POSTROUTING ACCEPT

# Cleanup.
#------------------------------------------------------------------------------

# Delete all
$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -t mangle -F

# Delete all
$IPTABLES -X
$IPTABLES -t nat -X
$IPTABLES -t mangle -X

# Zero all packets and counters.
$IPTABLES -Z
$IPTABLES -t nat -Z
$IPTABLES -t mangle -Z

# Completely disable IPv6.
#------------------------------------------------------------------------------

# Block all IPv6 traffic
# If the ip6tables command is available, try to block all IPv6 traffic.
if test -x $IP6TABLES; then
# Set the default policies
# drop everything
$IP6TABLES -P INPUT DROP 2>/dev/null
$IP6TABLES -P FORWARD DROP 2>/dev/null
$IP6TABLES -P OUTPUT DROP 2>/dev/null

# The mangle table can pass everything
$IP6TABLES -t mangle -P PREROUTING ACCEPT 2>/dev/null
$IP6TABLES -t mangle -P INPUT ACCEPT 2>/dev/null
$IP6TABLES -t mangle -P FORWARD ACCEPT 2>/dev/null
$IP6TABLES -t mangle -P OUTPUT ACCEPT 2>/dev/null
$IP6TABLES -t mangle -P POSTROUTING ACCEPT 2>/dev/null

# Delete all rules.
$IP6TABLES -F 2>/dev/null
$IP6TABLES -t mangle -F 2>/dev/null

# Delete all chains.
$IP6TABLES -X 2>/dev/null
$IP6TABLES -t mangle -X 2>/dev/null

# Zero all packets and counters.
$IP6TABLES -Z 2>/dev/null
$IP6TABLES -t mangle -Z 2>/dev/null
fi

# Custom user-defined chains.
#------------------------------------------------------------------------------

# LOG packets, then ACCEPT.
$IPTABLES -N ACCEPTLOG
$IPTABLES -A ACCEPTLOG -j $LOG $RLIMIT --log-prefix "ACCEPT "
$IPTABLES -A ACCEPTLOG -j ACCEPT

# LOG packets, then DROP.
$IPTABLES -N DROPLOG
$IPTABLES -A DROPLOG -j $LOG $RLIMIT --log-prefix "DROP "
$IPTABLES -A DROPLOG -j DROP

# LOG packets, then REJECT.
# TCP packets are rejected with a TCP reset.
$IPTABLES -N REJECTLOG
$IPTABLES -A REJECTLOG -j $LOG $RLIMIT --log-prefix "REJECT "
$IPTABLES -A REJECTLOG -p tcp -j REJECT --reject-with tcp-reset
$IPTABLES -A REJECTLOG -j REJECT

# Only allows RELATED ICMP types
# (destination-unreachable, time-exceeded, and parameter-problem).
# TODO: Rate-limit this traffic?
# TODO: Allow fragmentation-needed?
# TODO: Test.
$IPTABLES -N RELATED_ICMP
$IPTABLES -A RELATED_ICMP -p icmp --icmp-type destination-unreachable -j ACCEPT
$IPTABLES -A RELATED_ICMP -p icmp --icmp-type time-exceeded -j ACCEPT
$IPTABLES -A RELATED_ICMP -p icmp --icmp-type parameter-problem -j ACCEPT
$IPTABLES -A RELATED_ICMP -j DROPLOG

# Make It Even Harder To Multi-PING
$IPTABLES  -A INPUT -p icmp -m limit --limit 1/s --limit-burst 2 -j ACCEPT
$IPTABLES  -A INPUT -p icmp -m limit --limit 1/s --limit-burst 2 -j LOG --log-prefix PING-DROP:
$IPTABLES  -A INPUT -p icmp -j DROP
$IPTABLES  -A OUTPUT -p icmp -j ACCEPT

# Only allow the minimally required/recommended parts of ICMP. Block the rest.
#------------------------------------------------------------------------------

# TODO: This section needs a lot of testing!

# First, drop all fragmented ICMP packets (almost always malicious).
$IPTABLES -A INPUT -p icmp --fragment -j DROPLOG
$IPTABLES -A OUTPUT -p icmp --fragment -j DROPLOG
$IPTABLES -A FORWARD -p icmp --fragment -j DROPLOG

# Allow all ESTABLISHED ICMP traffic.
$IPTABLES -A INPUT -p icmp -m state --state ESTABLISHED -j ACCEPT $RLIMIT
$IPTABLES -A OUTPUT -p icmp -m state --state ESTABLISHED -j ACCEPT $RLIMIT

# Allow some parts of the RELATED ICMP traffic, block the rest.
$IPTABLES -A INPUT -p icmp -m state --state RELATED -j RELATED_ICMP $RLIMIT
$IPTABLES -A OUTPUT -p icmp -m state --state RELATED -j RELATED_ICMP $RLIMIT

# Allow incoming ICMP echo requests (ping), but only rate-limited.
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -j ACCEPT $RLIMIT

# Allow outgoing ICMP echo requests (ping), but only rate-limited.
$IPTABLES -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT $RLIMIT

# Drop any other ICMP traffic.
$IPTABLES -A INPUT -p icmp -j DROPLOG
$IPTABLES -A OUTPUT -p icmp -j DROPLOG
$IPTABLES -A FORWARD -p icmp -j DROPLOG

# Selectively allow certain special types of traffic.
#------------------------------------------------------------------------------

# Allow loopback interface to do anything.
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A OUTPUT -o lo -j ACCEPT

# Allow incoming connections related to existing allowed connections.
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow outgoing connections EXCEPT invalid
$IPTABLES -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

# Miscellaneous.
#------------------------------------------------------------------------------

# We don't care about Milkosoft, Drop SMB/CIFS/etc..
$IPTABLES -A INPUT -p tcp -m multiport --dports 135,137,138,139,445,1433,1434 -j DROP
$IPTABLES -A INPUT -p udp -m multiport --dports 135,137,138,139,445,1433,1434 -j DROP

# Explicitly drop invalid incoming traffic
$IPTABLES -A INPUT -m state --state INVALID -j DROP

# Drop invalid outgoing traffic, too.
$IPTABLES -A OUTPUT -m state --state INVALID -j DROP

# If we would use NAT, INVALID packets would pass - BLOCK them anyways
$IPTABLES -A FORWARD -m state --state INVALID -j DROP

# PORT Scanners (stealth also)
$IPTABLES -A INPUT -m state --state NEW -p tcp --tcp-flags ALL ALL -j DROP
$IPTABLES -A INPUT -m state --state NEW -p tcp --tcp-flags ALL NONE -j DROP

# TODO: Some more anti-spoofing rules? For example:
# $IPTABLES -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
# $IPTABLES -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
# $IPTABLES -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
$IPTABLES -N SYN_FLOOD
$IPTABLES -A INPUT -p tcp --syn -j SYN_FLOOD
$IPTABLES -A SYN_FLOOD -m limit --limit 2/s --limit-burst 6 -j RETURN
$IPTABLES -A SYN_FLOOD -j DROP

# TODO: Block known-bad IPs (see http://www.dshield.org/top10.php).
# $IPTABLES -A INPUT -s INSERT-BAD-IP-HERE -j DROPLOG

# Drop any traffic from IANA-reserved IPs.
#------------------------------------------------------------------------------

$IPTABLES -A INPUT -s 0.0.0.0/7 -j DROP
$IPTABLES -A INPUT -s 2.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 5.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 7.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 10.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 23.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 27.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 31.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 36.0.0.0/7 -j DROP
$IPTABLES -A INPUT -s 39.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 42.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 49.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 50.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 77.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 78.0.0.0/7 -j DROP
$IPTABLES -A INPUT -s 92.0.0.0/6 -j DROP
$IPTABLES -A INPUT -s 96.0.0.0/4 -j DROP
$IPTABLES -A INPUT -s 112.0.0.0/5 -j DROP
$IPTABLES -A INPUT -s 120.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 169.254.0.0/16 -j DROP
$IPTABLES -A INPUT -s 172.16.0.0/12 -j DROP
$IPTABLES -A INPUT -s 173.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 174.0.0.0/7 -j DROP
$IPTABLES -A INPUT -s 176.0.0.0/5 -j DROP
$IPTABLES -A INPUT -s 184.0.0.0/6 -j DROP
$IPTABLES -A INPUT -s 192.0.2.0/24 -j DROP
$IPTABLES -A INPUT -s 197.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 198.18.0.0/15 -j DROP
$IPTABLES -A INPUT -s 223.0.0.0/8 -j DROP
$IPTABLES -A INPUT -s 224.0.0.0/3 -j DROP

# Selectively allow certain outbound connections, block the rest.
#------------------------------------------------------------------------------

# Allow outgoing DNS requests. Few things will work without this.
$IPTABLES -A OUTPUT -m state --state NEW -p udp --dport 53 -j ACCEPT
$IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 53 -j ACCEPT

# Allow outgoing HTTP requests. Unencrypted, use with care.
$IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT

# Allow outgoing HTTPS requests.
$IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT

# Allow outgoing SMTPS requests. Do NOT allow unencrypted SMTP!
# $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 465 -j ACCEPT

# Allow outgoing "submission" (RFC 2476) requests.
$IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 587 -j ACCEPT

# Allow outgoing POP3S requests.
$IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 995 -j ACCEPT

# Allow outgoing SSH requests.
$IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 22 -j ACCEPT

# Allow outgoing FTP requests. Unencrypted, use with care.
$IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 21 -j ACCEPT

# Allow outgoing NNTP requests. Unencrypted, use with care.
# $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 119 -j ACCEPT

# Allow outgoing NTP requests. Unencrypted, use with care.
# $IPTABLES -A OUTPUT -m state --state NEW -p udp --dport 123 -j ACCEPT

# Allow outgoing IRC requests. Unencrypted, use with care.
# Note: This usually needs the ip_conntrack_irc kernel module.
# $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 6667 -j ACCEPT

# Allow outgoing requests to various proxies. Unencrypted, use with care.
# $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 8080 -j ACCEPT
# $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 8090 -j ACCEPT

# Allow outgoing DHCP requests. Unencrypted, use with care.
# TODO: This is completely untested, I have no idea whether it works!
# TODO: I think this can be tightened a bit more.
$IPTABLES -A OUTPUT -m state --state NEW -p udp --sport 67:68 --dport 67:68 -j ACCEPT

# Allow outgoing CVS requests. Unencrypted, use with care.
# $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 2401 -j ACCEPT

# Allow outgoing MySQL requests. Unencrypted, use with care.
# $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 3306 -j ACCEPT

# Allow outgoing SVN requests. Unencrypted, use with care.
# $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 3690 -j ACCEPT

# Allow outgoing PLESK requests. Unencrypted, use with care.
# $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 8443 -j ACCEPT

# Allow outgoing Tor (http://tor.eff.org) requests.
# Note: Do _not_ use unencrypted protocols over Tor (sniffing is possible)!
# $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 9001 -j ACCEPT
# $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 9002 -j ACCEPT
# $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 9030 -j ACCEPT
# $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 9031 -j ACCEPT
# $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 9090 -j ACCEPT
# $IPTABLES -A OUTPUT -m state --state NEW -p tcp --dport 9091 -j ACCEPT

# Allow outgoing OpenVPN requests.
$IPTABLES -A OUTPUT -m state --state NEW -p udp --dport 1194 -j ACCEPT

# TODO: ICQ, MSN, GTalk, Skype, Yahoo, etc...

# Selectively allow certain inbound connections, block the rest.
#------------------------------------------------------------------------------

# Allow incoming DNS requests.
$IPTABLES -A INPUT -m state --state NEW -p udp --dport 53 -j ACCEPT
$IPTABLES -A INPUT -m state --state NEW -p tcp --dport 53 -j ACCEPT

# Allow incoming HTTP requests.
$IPTABLES -A INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT

# Allow incoming HTTPS requests.
$IPTABLES -A INPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT

# Allow incoming POP3 requests.
$IPTABLES -A INPUT -m state --state NEW -p tcp --dport 110 -j ACCEPT

# Allow incoming IMAP4 requests.
$IPTABLES -A INPUT -m state --state NEW -p tcp --dport 143 -j ACCEPT

# Allow incoming POP3S requests.
$IPTABLES -A INPUT -m state --state NEW -p tcp --dport 995 -j ACCEPT

# Allow incoming SMTP requests.
$IPTABLES -A INPUT -m state --state NEW -p tcp --dport 25 -j ACCEPT

# Allow incoming SSH requests.
$IPTABLES -A INPUT -m state --state NEW -p tcp --dport 22 -j ACCEPT

# Allow incoming FTP requests.
$IPTABLES -A INPUT -m state --state NEW -p tcp --dport 21 -j ACCEPT

# Allow incoming NNTP requests.
# $IPTABLES -A INPUT -m state --state NEW -p tcp --dport 119 -j ACCEPT

# Allow incoming MySQL requests.
# $IPTABLES -A INPUT -m state --state NEW -p tcp --dport 3306 -j ACCEPT

# Allow incoming PLESK requests.
# $IPTABLES -A INPUT -m state --state NEW -p tcp --dport 8843 -j ACCEPT

# Allow incoming BitTorrent requests.
# TODO: Are these already handled by ACCEPTing established/related traffic?
# $IPTABLES -A INPUT -m state --state NEW -p tcp --dport 6881 -j ACCEPT
# $IPTABLES -A INPUT -m state --state NEW -p udp --dport 6881 -j ACCEPT

# Allow incoming nc requests.
# $IPTABLES -A INPUT -m state --state NEW -p tcp --dport 2030 -j ACCEPT
# $IPTABLES -A INPUT -m state --state NEW -p udp --dport 2030 -j ACCEPT

# Explicitly log and reject everything else.
#------------------------------------------------------------------------------

# Use REJECT instead of REJECTLOG if you don't need/want logging.
$IPTABLES -A INPUT -j REJECTLOG
$IPTABLES -A OUTPUT -j REJECTLOG
$IPTABLES -A FORWARD -j REJECTLOG

#------------------------------------------------------------------------------
# Testing the firewall.
#------------------------------------------------------------------------------

# You should check/test that the firewall really works, using
# iptables -vnL, nmap, ping, telnet, ...

# Appending rules : Let’s add some more IPv6 rules to our firewall.

sudo ip6tables -A INPUT -p tcp --dport ssh -s HOST_IPV6_IP -j ACCEPT
sudo ip6tables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo ip6tables -A INPUT -p tcp --dport 21 -j ACCEPT
sudo ip6tables -A INPUT -p tcp --dport 25 -j ACCEPT

# To see the IPv6 rules with line numbers, type the following command:

sudo ip6tables -L -n --line-numbers

# Deleting rules

sudo ip6tables -D INPUT -p tcp --dport 21 -j ACCEPT

# Exit gracefully.
#------------------------------------------------------------------------------

exit 0
Plenty more on found by Google................

Last edited by antimidas; 13th February 2020 at 06:36. Reason: formatting fix
Reply With Quote
  #10  
Old 18th February 2020, 20:57
rio's Avatar
rio rio is offline
Senior Member
 
Join Date: May 2019
P2P
Posts: 20
Default
Quote:
Originally Posted by Elena View Post
If the sessions of one and the same the IP (the same) is repeated more than 10 times, clean session for this pest, the IP shall be entered in the table with a note bans - Hacker .
Further bans work at the entrance to the site:
If IP is in the DB site is re-direction to the site ... CIA/FBI or Yandex/Google.
Run the query to the database:
Code:
ALTER TABLE `bans` ADD `haker` enum('yes','no') DEFAULT 'no';
Open the include / functions.php and paste to the end:
Code:
function ipv6_numeric($ip) {
    $binNum = '';
    foreach (unpack('C*', inet_pton($ip)) as $byte) {
        $binNum .= str_pad(decbin($byte), 8, "0", STR_PAD_LEFT);
    }
    return base_convert(ltrim($binNum, '0'), 2, 10);
}
Open index.php and replace what you have on it ( unless of course you do not append anything there! )
Code:
<? require_once("include/bittorrent.php");dbconn(true);header("Content-Type: text/html; charset=cp1251");
if(!$CURUSER){$ip = getip();$nip = ipv6_numeric($ip);
$sess = mysql_query("SELECT * FROM sessions WHERE ip = $nip") or sqlerr(__FILE__, __LINE__);
if (mysql_num_rows($sess) > 10){
mysql_query("INSERT INTO bans (added, addedby, first, last, comment, haker) VALUES (NOW(), 1, $nip, $nip, 'hakker', 'yes')") or sqlerr(__FILE__, __LINE__);
mysql_query("DELETE FROM sessions WHERE ip = $nip") or sqlerr(__FILE__, __LINE__);
print("<html><head><meta http-equiv=refresh content='0;url=https://www.fbi.gov/'></head></html>");}else{
////////////////////////////
$resd = mysql_query("SELECT * FROM bans WHERE $nip >= first AND $nip <= last AND haker = 'no'") or sqlerr(__FILE__, __LINE__);
if (mysql_num_rows($resd) > 0){$comment = mysql_fetch_assoc($resd);$comment = $comment["comment"];?><head><title>MySayt</title>
<meta name="copyright" content="MySayt" /><meta name="description" content="MySayt" /><meta name="keywords" content="MySayt" />
<link rel="shortcut icon" href="https://MySayt/favicon.ico" type="image/x-icon"></head>
<body style="background:black no-repeat center center fixed;-webkit-background-size:cover;-moz-background-size:cover;-o-background-size:cover;background-size:cover;">
<table align="center" width="100%" border="0px">
<td align="center" style="display:yes;position:fixed;margin-top:0px;" width="50%" border="0px">
<div style="display:yes;position:fixed;margin-top:285px;margin-left:470px;border:1px solid #bdbdbd;-moz-border-radius:6px;
border-radius:6px;-webkit-border-radius:6px;align:center;text-align:center;background:#e0e0e0;box-shadow:1px 1px 5px #5d5d5d;
-moz-box-shadow:1px 1px 5px #5d5d5d;-webkit-box-shadow:1px 1px 5px #5d5d5d;">
<table cellpadding="0" cellspacing="0" border="0" width="400px" height="200px"><tr><td align="right" height="5%">
<div style="padding:5px"><br><center><font color=#A52A2A><b>Error</b></font></center></div></td></tr>
<td style="padding-left:4px"><hr></td><tr><td align="left" width="100%" style="padding-left:4px;padding-bottom:2px;text-align:left;">
<div style="padding-left:2px" align="center"><center><font color="red"><b>Your IP is banned on the site!</b></font></center>
<br></div></td></tr></table></div></td></table></body><? die;}else{
$resr = mysql_query("SELECT * FROM bans WHERE $nip >= first AND $nip <= last AND haker = 'yes'") or sqlerr(__FILE__, __LINE__);
if(mysql_num_rows($resr) > 0){print("<html><head><meta http-equiv=refresh content='0;url=https://www.fbi.gov/'></head></html>");}}}
}else{
if(get_user_class() > UC_SYSOP || get_user_class() < UC_USER){
write_log("User ".$CURUSER["username"]." trying to fuck us! Ha-Ha! His IP=".getip()."","white","error");
 logoutcookie();mysql_query("update users set enabled='no' where id='".$CURUSER['id']."'");}stdhead();stdfoot();}?>

your code is kind of pointless if a site is getting DDOS then they should look on server level couz the server will crash if its overloaded thus the request will never been sent to php.
__________________
Live Free... Share Free...
Reply With Quote
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump



All times are GMT +2. The time now is 11:54. vBulletin skin by ForumMonkeys. Powered by vBulletin® Version 3.8.11 Beta 3
Copyright ©2000 - 2020, vBulletin Solutions Inc.