@anonympins/fingerprint 0.0.4 → 0.0.5

package/README.md

@@ -19,6 +19,7 @@ The process unfolds in three steps:
     *   **Device Behavior**: Rapid fingerprint changes (User-Agent rotation).
     *   **IP Behavior**: An excessive number of different devices seen from the same IP, or a single device using a large number of IPs (proxy rotation).
     *   **Inconsistency**: A low similarity score between the current fingerprint and the initial one associated with the `device_id` (cookie theft detection).
+    *   **Honeypot Trap**: Detection of bots that automatically fill hidden form fields or probe for common but unused URL parameters (e.g., `?debug=true`).
 3.  **Dynamic Challenge**: If the suspicion score exceeds a certain threshold, a challenge is presented to the user. The difficulty and type of challenge depend on the score:
     *   **Low to Medium Suspicion**: A combined CPU and Memory Proof-of-Work (PoW) challenge is issued. The difficulty of both the CPU (hash calculation) and Memory (allocation and computation) components scales progressively with the suspicion score. For low scores, the memory challenge is negligible, making it primarily a CPU task.
     *   **High Suspicion**: For the most suspicious requests, the system issues a high-difficulty combined CPU/Memory challenge. The architecture allows for plugging in more complex challenges like CAPTCHAs if needed.
@@ -40,7 +41,7 @@ This module is designed for a Node.js environment.
 
 ### Prerequisites
 
-Ensure you have a cookie-parser middleware (like `cookie-parser`) set up in your Express application.
+Ensure you have middleware for parsing cookies (like `cookie-parser`) and request bodies (like `express.json` and `express.urlencoded`) set up in your Express application *before* the `powMiddleware`.
 
 ### Configuration
 
@@ -56,11 +57,14 @@ The `powMiddleware` requires a configuration object defining the weights of susp
 
 ```javascript
 import express from 'express';
+import bodyParser from 'body-parser';
 import cookieParser from 'cookie-parser';
 import { powMiddleware /*, configurePow */ } from './fingerprint.js'; // Adjust the path
 
 const app = express();
 app.use(cookieParser());
+app.use(bodyParser.json()); // For parsing application/json
+app.use(bodyParser.urlencoded({ extended: true })); // For parsing application/x-www-form-urlencoded
 
 // Configuration of weights and thresholds for calculating the suspicion score.
 // These values should be adjusted based on traffic and expected user behavior.
@@ -69,7 +73,8 @@ const securityConfig = {
         historyScore: 0.3,       // Penalizes IP rotation (proxy)
         rotationScore: 0.5,      // Penalizes rapid fingerprint changes (user-agent, etc.)
         headerAnomalyScore: 0.1, // Penalizes abnormal headers (missing UA, etc.)
-        inconsistencyScore: 0.8  // Strongly penalizes inconsistency between the current and initial fingerprint (stolen cookie)
+        inconsistencyScore: 0.8, // Strongly penalizes inconsistency between the current and initial fingerprint (stolen cookie)
+        honeypotScore: 1.0       // Strongly penalizes bots filling hidden form fields
     },
     thresholds: {
         low: 20,    // Score from which a CPU challenge is issued
@@ -77,6 +82,16 @@ const securityConfig = {
         high: 75,   // Score for a very difficult challenge
         block: 95,  // Score above which the request is blocked outright (HTTP 403)
         isStaticResource: (req) => req.path.startsWith('/static/') // Optional: Custom function to identify static resources
+    },
+    honeypot: {
+        // List of field names that are traps for bots.
+        // These should be hidden in forms for humans, or be URL parameters your app never uses.
+        fields: ['email_confirm', 'user_nickname', 'debug', 'test_mode', 'admin'], // (Optional)
+        // List of URL paths that should never be accessed by a legitimate user.
+        // A request to one of these paths will immediately flag the device as malicious.
+        trapUrls: ['/wp-admin', '/.env', '/admin.php', '/phpmyadmin'], // (Optional)
+        // Automatically detect common SQL/NoSQL injection and RCE patterns in request values. (Optional, default: true)
+        detectInjections: true
     }
 };
 

package/fingerprint.js

@@ -398,6 +398,122 @@ function getHeaderAnomalies(context) {
   };
 }
 
+/**
+ * Checks for submitted honeypot fields to detect bots.
+ * @param {object} context - The request context.
+ * @param {object} honeypotConfig - The honeypot configuration.
+ * @returns {{honeypotScore: number}}
+ */
+function getHoneypotScore(context, honeypotConfig = {}) {
+  const { fields = [], trapUrls = [], detectInjections = true } = honeypotConfig;
+
+  // 1. Check for trap URL access
+  if (trapUrls.some(trap => context.path.startsWith(trap))) {
+    return { honeypotScore: 100 };
+  }
+
+  if (fields.length === 0 && !detectInjections) {
+    return { honeypotScore: 0 };
+  }
+
+  // Check both query parameters (for URL probing) and the request body (for hidden form fields).
+  const queryData =
+    context.query instanceof URLSearchParams
+      ? Object.fromEntries(context.query.entries())
+      : context.query || {};
+  const bodyData = context.body || {};
+
+  // 2. Check for honeypot field names
+  for (const field of fields) {
+    // A bot is trapped if the field exists in either the query OR the body.
+    if (
+      Object.prototype.hasOwnProperty.call(queryData, field) ||
+      Object.prototype.hasOwnProperty.call(bodyData, field)
+    ) {
+      return { honeypotScore: 100 }; // A bot fell into the trap, maximum score.
+    }
+  }
+
+  // 3. Check for injection attempts in values
+  if (detectInjections) {
+    // Regex for common SQL injection patterns
+    const sqlRegex = new RegExp(
+      "('|\"|;|--|#|/\\*.*\\*/)|\\b(union|select|insert|update|delete|drop|truncate)\\b",
+      "i"
+    );
+    // Regex for common NoSQL (MongoDB) injection patterns (e.g., keys starting with '$')
+    const nosqlKeyRegex = /"\$[^"]*":/;
+    // Regex for common Remote Code Execution (RCE) patterns
+    const rceRegex = new RegExp(
+      // File traversal, command execution functions, and shell commands
+      "(\\.\\./|\\.\\.\\\\)|\\b(exec|system|shell_exec|passthru|popen|proc_open|eval|assert|require|include)(_once)?\\s*\\(|\\b(wget|curl|bash|sh|powershell)\\b",
+      "i"
+    );
+
+    const inspect = (obj) => {
+        for (const key in obj) {
+            if (Object.prototype.hasOwnProperty.call(obj, key)) {
+                const value = obj[key];
+                if (typeof value === 'string') {
+                    if (rceRegex.test(value) || sqlRegex.test(value)) return true;
+                } else if (typeof value === 'object' && value !== null) {
+                    // For NoSQL, we check the stringified version of the object to find keys like "$gt"
+                    // This is more accurate when done on the object itself.
+                    if (nosqlKeyRegex.test(JSON.stringify(value))) return true;
+                    if (inspect(value)) return true;
+                }
+            }
+        }
+        return false;
+    };
+
+    if (inspect(queryData)) {
+        return { honeypotScore: 100 };
+    }
+    if (inspect(bodyData)) {
+        return { honeypotScore: 100 };
+    }
+  }
+
+  return { honeypotScore: 0 };
+}
+
+const trapUrlTemplates = [
+    '/includes/config-{RANDOM}.php',          // Classic PHP config file
+    '/.env.{RANDOM}',                         // Environment file
+    '/backups/db_backup_{RANDOM}.sql.gz',     // Database backup
+    '/api/v1/internal/status?trace={RANDOM}', // Internal API endpoint
+    '/_private/deploy_key_{RANDOM}.pem',      // Private key file
+    '/logs/app_error_{RANDOM}.log',           // Log file
+    '/.git/config_{RANDOM}'                   // Exposed git config variant
+];
+
+/**
+ * Generates a signed trap URL.
+ * @param {string} nonce - The nonce to sign the URL with.
+ * @returns {string} The trap URL.
+ */
+function generateTrapUrl(nonce) {
+    // Pick a random template to diversify the traps
+    const template = trapUrlTemplates[Math.floor(Math.random() * trapUrlTemplates.length)];
+    const randomPart = crypto.randomBytes(8).toString('hex');
+    const path = template.replace('{RANDOM}', randomPart);
+
+    const signature = crypto.createHmac('sha256', getPowSecret()).update(nonce + path).digest('hex').substring(0, 16);
+    return `${path}?sig=${signature}`;
+}
+
+/**
+ * Verifies if a given path is a valid trap URL for a given nonce.
+ * @param {string} path - The request path.
+ * @param {string} signature - The signature from the query.
+ * @param {string} nonce - The nonce to verify against.
+ * @returns {boolean}
+ */
+function verifyTrapUrl(path, signature, nonce) {
+    const expectedSignature = crypto.createHmac('sha256', getPowSecret()).update(nonce + path).digest('hex').substring(0, 16);
+    return signature === expectedSignature;
+}
 /**
  * @typedef {object} IStore
  * @property {(key: string) => Promise<any>} get
@@ -443,7 +559,6 @@ async function resolveRequestIdentity(context) {
   let consistencyScore = 1.0; // 1.0 = perfectly consistent
   let deviceData = null;
   let newCookie = null;
-
   if (deviceId) {
     deviceData = await store.get(`device:${deviceId}`);
   }
@@ -545,10 +660,10 @@ async function getBehavioralIndicators(context, deviceData) {
 /**
  * Returns a vector of raw (unweighted) suspicion scores.
  * @param {object} context - The request context object.
- * @returns {Promise<{historyScore: number, rotationScore: number, headerAnomalyScore: number, inconsistencyScore: number}>}
+ * @returns {Promise<{historyScore: number, rotationScore: number, headerAnomalyScore: number, inconsistencyScore: number, honeypotScore: number}>}
  */
-export const getSuspicionVector = async (context) => {
-  const { deviceId, deviceData, consistencyScore, newCookie } = await resolveRequestIdentity(context);
+export const getSuspicionVector = async (context, securityConfig) => {
+    const { deviceId, deviceData, consistencyScore, newCookie } = await resolveRequestIdentity(context);
 
   const clientIp = context.clientIp;
 
@@ -570,10 +685,11 @@ export const getSuspicionVector = async (context) => {
   const behavioral = await getBehavioralIndicators(context, deviceData);
   const { headerAnomalyScore } = getHeaderAnomalies(context);
   // Calculate the inconsistency score here, separately.
-  const inconsistencyScore = Math.min(100, Math.max(0, (1 - consistencyScore) * 200));
+  const inconsistencyScore = Math.min(100, Math.max(0, (1 - consistencyScore) * 200)); // Amplified score
 
 
   // Save the updated device state to the store
+  // Note: deviceData.ips is a Set, which may not serialize correctly in all stores (e.g., JSON). A Redis store should handle this via custom serialization or by converting to an array.
   await store.set(`device:${deviceId}`, deviceData);
 
   return { ...behavioral, headerAnomalyScore, inconsistencyScore };
@@ -595,17 +711,20 @@ const MAX_RAPID_CHANGES_PER_DEVICE = 3; // Number of rapid fingerprint changes a
  * Uses FingerprintBuilder to create a fingerprint based on headers
  * and IP, making spoofing more complex (requires changing the entire stack).
  */
-export const identifyRequest = async (req, res) => {
+export const identifyRequest = (securityConfig) => async (req, res) => {
   // This function now acts as a lightweight wrapper around the engine's identifyRequest method.
   // It requires a default configuration to work.
-  const defaultConfig = {
-    weights: { historyScore: 0.3, rotationScore: 0.5, headerAnomalyScore: 0.1, inconsistencyScore: 0.8 },
-    thresholds: { low: 20, medium: 40, high: 75 }
+  const config = securityConfig || {
+    weights: { historyScore: 0.3, rotationScore: 0.5, headerAnomalyScore: 0.1, inconsistencyScore: 0.8, honeypotScore: 1.0 },
+    thresholds: { low: 20, medium: 40, high: 75 },
+    honeypot: { fields: [] } // Ensure honeypot config exists to prevent errors
   };
-  const engine = new FingerprintEngine(defaultConfig);
+  const engine = new FingerprintEngine(config);
 
   const requestContext = {
       clientIp: req.ip || req.socket?.remoteAddress || "unknown",
+      query: req.query,
+      body: req.body,
       cookies: req.cookies,
       headers: req.headers,
       rawHeaders: req.rawHeaders,
@@ -744,9 +863,9 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
             await new Promise(r => setTimeout(r, 10)); // Yield to update UI
 
             let memSolution = 0;
-            const iterations = size / 16;
             try {
                 const size = ${memoryDifficulty} * 1024 * 1024;
+                const iterations = size / 16;
                 const buffer = new Uint32Array(size / 4);
                 const seed = nonce + ":" + clientSecret;
                 let h = new TextEncoder().encode(seed).reduce((acc, v) => acc + v, 0);
@@ -822,16 +941,27 @@ class FingerprintEngine {
       return { action: 'next', score: 0, vector: {} };
     }
 
+    // Check for persisted "condemned" status early.
+    const { deviceData } = await resolveRequestIdentity(requestContext);
+    if (deviceData?.condemned) {
+        return { action: 'block', status: 403, body: 'Forbidden', score: 100, vector: { honeypotScore: 100 } };
+    }
+
     // The engine now works with the context directly, no more rawReq dependency here.
-    const suspicionVector = await __internal.getSuspicionVector(requestContext);
+    const suspicionVector = await __internal.getSuspicionVector(requestContext, this.securityConfig);
+    const { honeypotScore } = getHoneypotScore(requestContext, this.securityConfig.honeypot);
+    suspicionVector.honeypotScore = honeypotScore;
 
     const finalScore =
       suspicionVector.historyScore * (weights.historyScore || 0) +
       suspicionVector.rotationScore * (weights.rotationScore || 0) +
       suspicionVector.headerAnomalyScore * (weights.headerAnomalyScore || 0) +
-      suspicionVector.inconsistencyScore * (weights.inconsistencyScore || 0);
+      suspicionVector.inconsistencyScore * (weights.inconsistencyScore || 0) +
+      honeypotScore * (weights.honeypotScore || 0);
 
-    const isSuspiciousHigh = finalScore >= thresholds.high;
+    const isBlocked = finalScore >= (thresholds.block || 95);
+
+    const isSuspiciousHigh = finalScore >= thresholds.high && !isBlocked;
     const isSuspiciousMedium = finalScore >= thresholds.medium;
     const isSuspicious = finalScore >= thresholds.low;
 
@@ -845,6 +975,32 @@ class FingerprintEngine {
     const powCookie = cookies?.pow_clearance;
     const { pow_type, pow_nonce, pow_solution, pow_solution_cpu, pow_solution_mem } = query;
 
+    // Honeypot: Direct probing of challenge endpoints is highly suspicious.
+    // A legitimate user only hits these endpoints via the challenge page itself.
+    if (pow_nonce && !isSuspicious) {
+      if (logger) {
+          logger({ type: 'honeypot_probe', deviceId: cookies?.device_id, score: finalScore, path: path, timestamp: Date.now() });
+      }
+      suspicionVector.honeypotScore = 100; // Bot is probing. Max penalty.
+      // Recalculate score and block immediately.
+      const newFinalScore = finalScore + (100 * (weights.honeypotScore || 0));
+      return { action: 'block', status: 403, body: 'Forbidden', score: newFinalScore, vector: suspicionVector };
+    }
+
+    // If the action is to block, we should still include the score and vector for logging/testing.
+    if (isBlocked) {
+      return { action: 'block', status: 403, body: 'Forbidden', score: finalScore, vector: suspicionVector };
+    }
+
+    // Honeypot: Check if the request is for a trap URL generated in a previous challenge.
+    // This requires a nonce from a *previous* challenge, which we can look up via the device ID.
+    const lastNonce = deviceData?.lastChallengeNonce;
+    if (lastNonce && query.sig && verifyTrapUrl(path, query.sig, lastNonce)) {
+        deviceData.condemned = true; // This device is a bot. Condemn it.
+        await store.set(`device:${cookies.device_id}`, deviceData);
+        return { action: 'block', status: 403, body: 'Forbidden', score: 100, vector: { honeypotScore: 100 } };
+    }
+
     if (isSuspicious && !isTicketValid(clientIp, powCookie)) {
         // --- CHALLENGE SOLUTION HANDLING ---
         if (pow_nonce && (pow_solution || (pow_solution_cpu && pow_solution_mem))) {
@@ -925,6 +1081,12 @@ class FingerprintEngine {
         // Store the secret with a short TTL (e.g., 5 minutes)
         await store.set(`secret:${nonce}`, clientSecret, 300);
 
+        // Associate the current challenge nonce with the device for trap URL verification later.
+        if (deviceData) {
+            deviceData.lastChallengeNonce = nonce;
+            await store.set(`device:${cookies.device_id}`, deviceData);
+        }
+
         if (logger) {
             logger({ type: 'challenge_issued', deviceId: cookies?.device_id, score: finalScore, timestamp: Date.now() });
         }
@@ -936,6 +1098,12 @@ class FingerprintEngine {
 
         // UNIFIED CHALLENGE LOGIC for all suspicion levels (low, medium, high)
         if (isSuspicious) { // Couvre à la fois low et medium
+            // Generate some trap URLs to embed in the challenge page.
+            // These links are visually hidden but present in the DOM to trap bots.
+            const trapUrls = Array.from({ length: 3 }, () => generateTrapUrl(nonce));
+            const trapLinksHtml = trapUrls.map(url => `<a href="${url}" tabindex="-1">config</a>`).join(' ');
+
+
             const cpuChallengeDetails = generateCpuTargetChallenge(clientIp, nonce, suspicionFactor, path);
 
             // La difficulté mémoire démarre à 0 et augmente seulement après un certain seuil de suspicion.
@@ -947,7 +1115,8 @@ class FingerprintEngine {
             const memDifficulty = Math.round(minMemDifficulty + memActivationFactor * (maxMemDifficulty - minMemDifficulty));
 
             // Always use the combined page, even if memory difficulty is 0 (it will be almost instant).
-            const page = generateCombinedPoWChallengePage(cpuChallengeDetails, memDifficulty, clientIp, clientSecret);
+            const trapContainer = `<div style="position:absolute;left:-9999px;top:-9999px;" aria-hidden="true">${trapLinksHtml}</div>`;
+            const page = generateCombinedPoWChallengePage(cpuChallengeDetails, memDifficulty, clientIp, clientSecret).replace('</body>', `${trapContainer}</body>`);
             return { action: 'challenge', score: finalScore, vector: suspicionVector, status: 429, body: page };
         }
     }
@@ -992,12 +1161,14 @@ class FingerprintEngine {
     }
     await store.set(`ip:${clientIp}`, ipProfile);
 
-    const vector = await __internal.getSuspicionVector(requestContext);
+    const vector = await __internal.getSuspicionVector(requestContext, this.securityConfig); // Pass the config
+    const { honeypotScore } = getHoneypotScore(requestContext, this.securityConfig.honeypot);
     const score =
       vector.historyScore * (this.securityConfig.weights.historyScore || 0.3) +
       vector.rotationScore * (this.securityConfig.weights.rotationScore || 0.5) +
       vector.headerAnomalyScore * (this.securityConfig.weights.headerAnomalyScore || 0.1) +
-      vector.inconsistencyScore * (this.securityConfig.weights.inconsistencyScore || 0.8);
+      vector.inconsistencyScore * (this.securityConfig.weights.inconsistencyScore || 0.8) +
+      honeypotScore * (this.securityConfig.weights.honeypotScore || 0);
 
     if (score >= this.securityConfig.thresholds.high) return `suspicious_high:${clientIp}`;
     if (score >= this.securityConfig.thresholds.low) return `suspicious_medium:${clientIp}`; // Use medium for any suspicion
@@ -1028,6 +1199,7 @@ export const powMiddleware = (securityConfig) => {
       path: req.path,
       cookies: req.cookies,
       query: req.query,
+      body: req.body,
       headers: req.headers,
       isStatic: isStaticResource(req.path),
       // Add the newly required properties for full decoupling

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anonympins/fingerprint",
-  "version": "0.0.4",
+  "version": "0.0.5",
   "description": "An HTTP(S) client mitigation and anti-bot protection library for Node.js/Express, based on digital fingerprinting and dynamic Proof-of-Work (PoW) challenges.",
   "main": "fingerprint.js",
   "type": "module",
@@ -40,6 +40,7 @@
   },
   "homepage": "https://github.com/anonympins/fingerprint#readme",
   "devDependencies": {
+    "body-parser": "^1.20.2",
     "cookie-parser": "^1.4.6",
     "express": "^4.18.2",
     "vitest": "^4.1.11"