@anonympins/fingerprint 0.4.3 → 0.4.5

package/CHANGELOG.md

@@ -1,3 +1,46 @@
+## Version 0.4.5
+
+### ✨ New Features
+
+- **Stateless PoW Ticket Validation**: Introduced cryptographically secure stateless Proof-of-Work (PoW) tickets. These tickets are encrypted and signed, allowing for tamper-proof validation without requiring server-side storage, improving scalability and resilience.
+- **TCP Anomaly Score**: Implemented a new `tcpAnomalyScore` based on passive TCP/IP fingerprinting (p0f-like analysis). This score detects inconsistencies between the client's TCP stack (TTL, window size, options) and its User-Agent, indicating potential spoofing or bot activity.
+- **Dynamic WebAssembly (WASM) Modules**: Introduced polymorphic WASM module generation. The client-side WASM solver now generates unique, randomized code for each request or session, significantly increasing the cost and difficulty for bots to fingerprint, reverse-engineer, and bypass.
+
+### 🚀 Improvements
+
+- **Enhanced Client Hints Inconsistency Detection**: Improved the `clientHintsInconsistencyScore` calculation for more precise detection of discrepancies between User-Agent and Client Hints headers, leading to more accurate bot identification.
+
+### 🛡️ Security Enhancements
+
+- **PHP DoS Prevention**: Implemented specific measures in the PHP engine to prevent Denial-of-Service (DoS) attacks, ensuring stability and resource protection under high load or malicious activity.
+
+### 📚 Documentation
+
+- **README Update**: Updated `README.md` to reflect the latest features and changes in the library.
+
+---
+
+## Version 0.4.4
+
+### 🧮 Pattern Score Ratios & Weighted Subscores
+- **Linear Weighted Pattern Scores**: Introduced configurable ratios (`regularityRatio`, `benfordRatio`, `enumerationRatio`) to dynamically adjust the influence of timing regularity, Benford's law deviation, and sequential path enumeration on the final `requestPatternScore`.
+
+### 🕸️ Advanced Client Tracking & Touch Analysis
+- **Mobile Client Touch Analysis**: Implemented detailed analysis of mobile touch events, extracting advanced behavioral metrics such as average pressure, touch radius size, coordinate variance, and multi-touch count to effectively detect automated touch emulation.
+- **WASM Client Caching with IndexedDB**: Added client-side persistent storage of compiled WebAssembly modules in IndexedDB (`wasm-cache-db`) to drastically reduce initialization times, skipping compilation overhead on subsequent visits.
+- **Phantom Interactive Traps**: Added invisible phantom interactive link traps to hook headlessly automated clients via hover/focus events.
+
+### 🛡️ Enhanced Honeypot Protections & Extensibility
+- **External Analyzers Support**: Extended the honeypot subsystem to allow plugging in external analyzers (e.g., custom regex matching or WAF frameworks like ModSecurity) to evaluate request payloads.
+- **Optimized Injection Filters**: Refined input inspection to recursively search deeply nested NoSQL/SQL structures using centralized security algorithms.
+
+### 📶 Stable Subnet Reputation & Rate Limiting
+- **Hardware-Anchored Subnet Metrics**: Refactored subnet score aggregations to anchor suspicious activities to hardware-based device hashes (`deviceHash`) rather than easily cleared tracking cookies, preventing proxy rotation masking.
+- **Subnet Challenge Rate Limiting**: Integrated a Token Bucket rate limiter (`checkChallengeRateLimit`) that throttles challenge requests per IPv4/IPv6 subnet to prevent denial of service (DoS) attacks on verification systems.
+
+### 🤖 Botnet Clustering & Similarity Scores
+- **Botnet Cluster Score**: Implemented network-wide botnet detection (`botnetClusterScore`) using exponential mathematical decay. It groups volatile client requests that share identical stable hardware profiles across distinct IP addresses within a rolling 10-minute window.
+
 ## Version 0.4.3
 
 ### 🔒 Rotation Score Hardening (Anti-Spoofing & No-JS Parity)

package/README.md

@@ -6,10 +6,14 @@ NodeJS tests : [![Test NodeJS](https://img.shields.io/github/actions/workflow/st
 [![License](https://img.shields.io/github/license/anonympins/fingerprint)](https://github.com/anonympins/fingerprint/blob/main/LICENSE)
 ![GitHub commit activity](https://img.shields.io/github/commit-activity/w/anonympins/fingerprint)
 
-A multi-layered behavioral, cryptographic, and network analysis engine designed to identify and mitigate malicious requests (bots, scrapers, session hijacking) in real-time. Supports both **Node.js** and **PHP** environments.
+A multi-layered behavioral, cryptographic, and network analysis engine designed to identify and mitigate malicious requests (bots, scrapers, session hijacking, bot farms) in real-time. Supports **Node.js**, **Python** and **PHP** environments.
 
 ![illustration](https://i.ibb.co/fV1QT6Mf/image-c6e10859baae53bb595112ec08fc9e27.png)
 
+### Presentation video
+
+[![Presentation](https://i.ibb.co/1tkPS01C/Capture-d-cran-2026-09-07-194728.png)](https://www.youtube.com/watch?v=Ujeznl0JAl4)
+
 ## Key Features
 
 - **Multi-Layered Detection**: Combines TLS/JA3/JA4 analysis, HTTP header consistency checks, IP reputation, and behavioral tracking (mouse movements, keystrokes).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anonympins/fingerprint",
-  "version": "0.4.3",
+  "version": "0.4.5",
   "description": "Advanced anti-bot library for Node.js using multi-layer fingerprinting (JA3, client-side, headers), behavioral analysis, and adaptive Proof-of-Work (PoW) challenges to mitigate scraping, scalping, and automated threats.",
   "main": "index.js",
   "type": "module",

package/src/js/dynamic-wasm.js

@@ -0,0 +1,158 @@
+import crypto from "node:crypto";
+
+function encodeULEB128(val) {
+    const bytes = [];
+    let num = val >>> 0;
+    do {
+        let byte = num & 0x7f;
+        num >>>= 7;
+        if (num !== 0) byte |= 0x80;
+        bytes.push(byte);
+    } while (num !== 0);
+    return bytes;
+}
+
+function encodeSLEB128(val) {
+    const bytes = [];
+    let num = val | 0;
+    while (true) {
+        let byte = num & 0x7f;
+        num >>= 7;
+        if ((num === 0 && (byte & 0x40) === 0) || (num === -1 && (byte & 0x40) !== 0)) {
+            bytes.push(byte);
+            break;
+        }
+        bytes.push(byte | 0x80);
+    }
+    return bytes;
+}
+
+export class DynamicWasmGenerator {
+    /**
+     * Generates a unique polymorphic WebAssembly module containing a custom hash function
+     * with randomized constants and control flow variables.
+     * @param {object} constants - Custom seed, multiplier and adder.
+     * @returns {Buffer} Valid WebAssembly binary buffer.
+     */
+    static generate(constants) {
+        const { seed, multiplier, adder } = constants;
+
+        const inst = [
+            0x01, 0x02, 0x7f, // Locals: 1 entry of 2 locals of type i32
+            // h = seed
+            0x41, ...encodeSLEB128(seed),
+            0x21, 0x03,
+            // i = 0
+            0x41, 0x00,
+            0x21, 0x02,
+
+            // block
+            0x02, 0x40,
+            // loop
+            0x03, 0x40,
+
+            // if i >= len break
+            0x20, 0x02,
+            0x20, 0x01,
+            0x4f,
+            0x0d, 0x01,
+
+            // byte = load8_u(ptr + i)
+            0x20, 0x00,
+            0x20, 0x02,
+            0x6a,
+            0x2d, 0x00, 0x00,
+
+            // h = h ^ byte
+            0x20, 0x03,
+            0x73,
+
+            // h = h * multiplier
+            0x41, ...encodeSLEB128(multiplier),
+            0x6c,
+
+            // h = h + adder
+            0x41, ...encodeSLEB128(adder),
+            0x6a,
+
+            // local.set 3
+            0x21, 0x03,
+
+            // i = i + 1
+            0x20, 0x02,
+            0x41, 0x01,
+            0x6a,
+            0x21, 0x02,
+
+            // br 0
+            0x0c, 0x00,
+
+            0x0b, // end loop
+            0x0b, // end block
+
+            // return h
+            0x20, 0x03,
+            0x0b // end function
+        ];
+
+        const funcBody = [
+            ...encodeULEB128(inst.length),
+            ...inst
+        ];
+
+        const codeSectionPayload = [
+            ...encodeULEB128(1),
+            ...funcBody
+        ];
+
+        const codeSection = [
+            0x0a,
+            ...encodeULEB128(codeSectionPayload.length),
+            ...codeSectionPayload
+        ];
+
+        const typeSection = [
+            0x01, 0x07, 0x01, 0x60, 0x02, 0x7f, 0x7f, 0x01, 0x7f
+        ];
+
+        const funcSection = [
+            0x03, 0x02, 0x01, 0x00
+        ];
+
+        const memSection = [
+            0x05, 0x03, 0x01, 0x00, 0x01
+        ];
+
+        const exportSection = [
+            0x07, 0x11, 0x02, 0x04, 0x68, 0x61, 0x73, 0x68, 0x00, 0x00, 0x06, 0x6d, 0x65, 0x6d, 0x6f, 0x72, 0x79, 0x02, 0x00
+        ];
+
+        const wasm = [
+            0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00,
+            ...typeSection,
+            ...funcSection,
+            ...memSection,
+            ...exportSection,
+            ...codeSection
+        ];
+
+        return Buffer.from(wasm);
+    }
+
+    /**
+     * Pure JavaScript fallback equivalent of the custom polymorphic hash.
+     * @param {string} str Input string.
+     * @param {object} constants Parameters.
+     * @returns {number} 32-bit unsigned integer hash.
+     */
+    static hashJs(str, constants) {
+        const { seed, multiplier, adder } = constants;
+        let h = seed | 0;
+        for (let i = 0; i < str.length; i++) {
+            const byte = str.charCodeAt(i) & 0xff;
+            h = h ^ byte;
+            h = Math.imul(h, multiplier) + adder;
+        }
+        return h >>> 0;
+    }
+}