@anonympins/fingerprint 0.5.5 → 0.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +7 -0
- package/README.md +7 -6
- package/package.json +1 -1
- package/src/js/fingerprint.client.js +17 -5
- package/src/js/fingerprint.client.obfuscated.js +1 -1
- package/src/js/fingerprint.js +229 -63
- package/src/js/problem-manager.js +22 -0
- package/src/js/tests/fingerprint.client.test.js +130 -128
- package/src/js/tests/fingerprint.test.js +17 -2
- package/src/js/ttl-optimization.worker.js +51 -0
- package/src/php/Challenge/ChallengeUtils.php +57 -6
- package/src/php/FingerprintBuilder.php +193 -185
- package/src/php/FingerprintEngine.php +146 -0
- package/src/php/ProblemManager.php +20 -0
- package/src/php/Tests/ChallengeUtilsTest.php +446 -285
- package/src/php/Utils/RequestUtils.php +19 -0
package/CHANGELOG.md
CHANGED
|
@@ -1,3 +1,10 @@
|
|
|
1
|
+
## Version 0.6.0
|
|
2
|
+
|
|
3
|
+
- **🛡️ Cooperative Challenge Better Security**: Hardened cooperative Proof-of-Space and challenge routing mechanics within subnet peers, preventing rogue registrations and ensuring high-fidelity security validation on decentralized networks (Contributed by @anonympins).
|
|
4
|
+
- **⚡ Math Optimizations & TTL Worker**: Optimized performance for 64-bit integers and the `cyrb53` hashing implementation on PHP 7+, reducing CPU overhead. Integrated automated background TTL optimization worker execution (Contributed by @anonympins).
|
|
5
|
+
- **🧹 IP Pruning**: Standardized and optimized IP pruning and rate-limiting data lifecycles to prevent memory exhaustion and leaks during high-concurrency scraping attempts (Contributed by @anonympins).
|
|
6
|
+
- Java integration (see README and wiki)
|
|
7
|
+
|
|
1
8
|
## Version 0.5.5
|
|
2
9
|
|
|
3
10
|
- **🔒 Client Session Handshake & HMAC Metric Signing**: Implemented elliptic-curve Diffie-Hellman (ECDH over curve `P-256`) key exchange protocol during client initialization (`?fp_handshake=1`). Leveraged the negotiated session key to cryptographically sign behavioral metrics (`signMetrics`) on the client using HMAC-SHA256, protecting against replay attacks and telemetry tampering.
|
package/README.md
CHANGED
|
@@ -1,17 +1,17 @@
|
|
|
1
1
|
# Fingerprint anti-bot protection
|
|
2
2
|
|
|
3
|
-
NodeJS tests : [](https://github.com/anonympins/fingerprint/actions/workflows/ci-nodejs.yml) / PHP tests : [](https://github.com/anonympins/fingerprint/actions/workflows/ci-php.yml) / Python tests : [](https://github.com/anonympins/fingerprint/actions/workflows/ci-nodejs.yml) / PHP tests : [](https://github.com/anonympins/fingerprint/actions/workflows/ci-php.yml) / Python tests : [](https://github.com/anonympins/fingerprint/actions/workflows/ci-python.yml) / Java tests : [](https://github.com/anonympins/fingerprint/actions/workflows/ci-java.yml)
|
|
4
4
|
|
|
5
5
|
[](https://github.com/anonympins/fingerprint/releases)
|
|
6
6
|
[](https://github.com/anonympins/fingerprint/blob/main/LICENSE)
|
|
7
7
|
[](https://github.com/anonympins/fingerprint/commits/main)
|
|
8
8
|
[](https://github.com/anonympins/fingerprint)
|
|
9
9
|
|
|
10
|
-
A multi-layered behavioral, cryptographic, and network analysis production-grade engine designed to identify and mitigate malicious requests (bots, scrapers, session hijacking, bot farms) in real-time. Supports **Node.js**, **Python** and **PHP** environments.
|
|
10
|
+
A multi-layered behavioral, cryptographic, and network analysis production-grade engine designed to identify and mitigate malicious requests (bots, scrapers, session hijacking, bot farms) in real-time. Supports **Node.js**, **Java**, **Python** and **PHP** environments.
|
|
11
11
|
|
|
12
12
|
It leverages multi-layer hardware fingerprinting, real-time behavioral analysis, passive network/TLS tracking, and adaptive/useful proof-of-work challenges to dynamically detect and mitigate scraping, scalping, account takeover (ATO), and sophisticated automated threats.
|
|
13
13
|
|
|
14
|
-
Supported officially on **Node.js (>=20.0.0)**, **PHP (>=8.0)**, and **Python (>=3.8)**.
|
|
14
|
+
Supported officially on **Node.js (>=20.0.0)**, **PHP (>=8.0)**, Java (>=17), and **Python (>=3.8)**.
|
|
15
15
|
|
|
16
16
|
|
|
17
17
|
|
|
@@ -85,9 +85,10 @@ To prevent documentation drift, all detailed guides and reference materials are
|
|
|
85
85
|
1. **[Key Concepts & Suspicion Vectors](https://github.com/anonympins/fingerprint/wiki/concepts)**: Learn how the engine calculates suspicion scores across the 15 distinct vectors and manages the Proof-of-Work mitigation layers.
|
|
86
86
|
2. **[Node.js Integration Guide](https://github.com/anonympins/fingerprint/wiki/nodejs_integration)**: Step-by-step instructions for Express.js middleware and raw HTTP server integrations.
|
|
87
87
|
3. **[PHP Integration Guide](https://github.com/anonympins/fingerprint/wiki/php_integration)**: Configuration details for direct PHP integration, TLS fingerprinting forwarding via Nginx/Apache, and securing Prometheus metrics.
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
88
|
+
4. **[Python Integration Guide](https://github.com/anonympins/fingerprint/wiki/python_integration)**: Python middleware for ASGI and WSGI integration.
|
|
89
|
+
5. **[Java Integration Guide](https://github.com/anonympins/fingerprint/wiki/java_integration)**: Java library (Servlet, Spring WebFlux)
|
|
90
|
+
6. **[Full Configuration Options](https://github.com/anonympins/fingerprint/wiki/full_options)**: Complete parameter list for fine-tuning weights, custom honeypots, and security profile overrides.
|
|
91
|
+
7. **[API Reference](https://github.com/anonympins/fingerprint/wiki/api_reference)**: Public API signatures and guides on substituting the in-memory datastore with Redis or MongoDB.
|
|
91
92
|
|
|
92
93
|
Start with the **[Documentation Portal](https://github.com/anonympins/fingerprint/wiki/home)** for a complete index.
|
|
93
94
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@anonympins/fingerprint",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.6.0",
|
|
4
4
|
"description": "Advanced anti-bot library for Node.js using multi-layer fingerprinting (JA3, client-side, headers), behavioral analysis, and adaptive Proof-of-Work (PoW) challenges to mitigate scraping, scalping, and automated threats.",
|
|
5
5
|
"main": "index.js",
|
|
6
6
|
"type": "module",
|
|
@@ -1340,11 +1340,23 @@ const ClientLibrary = {
|
|
|
1340
1340
|
window.wasmModule = wasmModule;
|
|
1341
1341
|
ClientLibrary.wasmModule = wasmModule;
|
|
1342
1342
|
|
|
1343
|
-
|
|
1344
|
-
|
|
1345
|
-
|
|
1346
|
-
|
|
1347
|
-
|
|
1343
|
+
// Pooling de mémoire statique : pré-allocation d'un buffer réutilisable de 4 Ko
|
|
1344
|
+
// Évite d'allouer/libérer de la mémoire sur le tas Emscripten lors des frappes clavier/mouvements souris rapides
|
|
1345
|
+
const staticBufferSize = 4096;
|
|
1346
|
+
const staticBufferPtr = wasmModule._malloc(staticBufferSize);
|
|
1347
|
+
const encoder = new TextEncoder();
|
|
1348
|
+
|
|
1349
|
+
// 4. Remplacer la fonction de hachage par la version WASM optimisée via le buffer statique
|
|
1350
|
+
activeCyrb53 = (str) => {
|
|
1351
|
+
const bytes = encoder.encode(str);
|
|
1352
|
+
if (bytes.length < staticBufferSize) {
|
|
1353
|
+
wasmModule.HEAPU8.set(bytes, staticBufferPtr);
|
|
1354
|
+
wasmModule.HEAPU8[staticBufferPtr + bytes.length] = 0; // null-terminator
|
|
1355
|
+
return wasmModule._hash_string(staticBufferPtr);
|
|
1356
|
+
}
|
|
1357
|
+
// Fallback dynamique sécurisé si la chaîne dépasse la taille du buffer statique
|
|
1358
|
+
return wasmModule._hash_string(str);
|
|
1359
|
+
};
|
|
1348
1360
|
|
|
1349
1361
|
console.log('[Fingerprint] WASM module loaded successfully. Using fast hashing.');
|
|
1350
1362
|
// NOUVEAU: Ajoute un indicateur à l'empreinte pour que le serveur sache que le WASM est actif.
|