metas-detect

NodeJS detect hack attempts

New version 2.0

Now 'metas-detect' is an expressjs' middleware.

This module can :

• Identify bots
• Geolocate IPs
• Parse visitor language
• Detect basic hack attemps
• Redirect attackers
• Log any visit into storage
• Query logs to build statistics

It better to use it with a winston supported storage and currently, only winston-mongodb is implemented.

You're really welcome if you want to contribute at this repository and have some good features to add :)

Installation

npm install --save metas-detect

Usage

// Load library
var MetasDetect = require('metas-detect');

// Instanciate the metasDetect
var metasDetect = new MetasDetect({
    mongodb: {
        db: 'mongodb://locahost/@yourdb',
        username: 'optional',
        password: 'optional'
    }
})

// Load express
var express = require('express');
var app = express();

// Install metasDetect middleware
app.use(metasDetect.middleware.bind(metasDetect))

Options

    # Hack attempt
    # ------------

        # Display a blue screen of death if an attack is detected ?
        # Stop request here
        hackers_bsod: true

        # Waste time of the hacker before sending a response
        hackers_sleep: 2000

        # The image that scares
        hackers_responseTxt: '''
                uuuuuuu
             uu$$$$$$$$$$$uu
          uu$$$$$$$$$$$$$$$$$uu
         u$$$$$$$$$$$$$$$$$$$$$u
        u$$$$$$$$$$$$$$$$$$$$$$$u
       u$$$$$$$$$$$$$$$$$$$$$$$$$u
       u$$$$$$$$$$$$$$$$$$$$$$$$$u
       u$$$$$$"   "$$$"   "$$$$$$u
       "$$$$"      u$u       $$$$"
        $$$u       u$u       u$$$
        $$$u      u$$$u      u$$$
         "$$$$uu$$$   $$$uu$$$$"
          "$$$$$$$"   "$$$$$$$"
            u$$$$$$$u$$$$$$$u
             u$"$"$"$"$"$"$u
  uuu        $$u$ $ $ $ $u$$       uuu
 u$$$$        $$$$$u$u$u$$$       u$$$$
  $$$$$uu      "$$$$$$$$$"     uu$$$$$$
u$$$$$$$$$$$uu    """""    uuuu$$$$$$$$$$
$$$$"""$$$$$$$$$$uuu   uu$$$$$$$$$"""$$$"
 """      ""$$$$$$$$$$$uu ""$"""
           uuuu ""$$$$$$$$$$uuu
  u$$$uuu$$$$$$$$$uu ""$$$$$$$$$$$uuu$$$
  $$$$$$$$$$""""           ""$$$$$$$$$$$"
   "$$$$$"[      MSG1:22         ]""$$$$""
     $$$"[       MSG2:23         ]$$$$"
        '''

        # Rules to detect attack
        hackers_honeypots:
            'url': [/^(\/administrator\/|\/wp-admin\/|(.*)\.php)/]


    # Bots detection rules
    # --------------------
    bots_honeypots:
        'ua': [
            /(http|https)/
            /BingPreview/
            /Google\ favicon/
            /spider/i
            /crawler/i
            /Twitterbot/i
        ]
        'url': [
            /SiteAuth\.xml$/i
            /^\/robots\.txt$/
        ]


    # Static files detection rules
    # ----------------------------
    static_honeypot: /\.(js|css|woff|woff2|ttf|eot|png|jpg|gif|ico|svg)$/i    

Query logs

You can query datas from storage like the example below.

Get all logs for the current day :

    timeRef = moment()
    metasDetect.query({
        from: timeRef.clone().startOf('day').toDate()
        until: timeRef.clone().endOf('day').toDate()
        start: 0
        limit: 10000
        order: 'asc'
    }, (err, results) ->
        console.log(err, results)
    )