Quarantyne - Modern Spider Web Firewall: Destination Trouble Organization Human Relationship Takeovers, Weak Passwords, Cloud Ips, Dos Attacks, Disposable Emails

Automated spider web safety made simple
Quarantyne is a reverse-proxy that protects spider web applications in addition to APIs from fraudulent behavior, misuse, bots in addition to cyber-attacks inward real-time.

Requirements

• Java 8

Presentation
Quarantyne is a reverse-proxy written inward java. It fronts a spider web application or API in addition to protects it from fraudulent behavior, misuse, bots in addition to cyber-attacks. It cannot halt them all, but it volition definitely become far harder in addition to to a greater extent than expensive to perform.
It's similar a firewall but smarter, because it does non simply block traffic because the user-agent is non inward a whitelist. Quarantyne too performs deep asking inspection to honor if, for example, the password used has been compromised before, or if the e-mail is disposable, alongside minimal configuration in addition to no changes inward your application. Our coverage department exactly lists what Quarantyne tin lavatory identify.

Features

Wide coverage of mutual HTTP threats in addition to misuse
See coverage for a consummate listing of the threats in addition to misuse Quarantyne tin lavatory position in addition to stop.

Deep traffic analysis
Quarantyne performs deep inspection of spider web traffic going to your application to verify that the information beingness sent is non compromised or junk.

Generic integration
Quarantyne adds extra HTTP headers to the asking it proxies to your service. For example, an HTTP asking coming from AWS volition deport the next headers:

• X-Quarantyne-Labels: PCX
• X-Quarantyne-RequestId: 08a0e31a-f1a5-4660-9316-0fdf5d2a959d

Active protection
Quarantyne tin lavatory survive configured to halt malicious requests from reaching your servers, avoiding wasting computing/DB/cache resources, metrics skew, junk data... See (Passive vs Active)[#passivevsactive].

Metrics & wellness reporting
Quarantyne binds to an internal adminPort, where metrics (latencies, success rate...) equally good equally the wellness of the proxy are reported.

Privacy friendly / GDPR compliance
Quarantyne is offline software. It runs within your person network in addition to does non communicate over the Internet alongside anyone to part information well-nigh your traffic, your business, or your users.

Ops Friendly.
Single jounce alongside 0 dependencies. Metrics are available on [proxyHost]:[adminPort]/metrics. Service wellness is available on [proxyHost]:[adminPort]/health

Coverage
Quarantyne is able to honor the next threats in addition to misuse.

Label	Definition	Behavior	Implemented
LBD	Large Body Data	Overload target's shape processor alongside POST/PUT asking alongside trunk > 1MB	yes
FAS	Fast Browsing	Request charge per unit of measurement faster than regular human browsing	yes
CPW	Compromised Password	Password used is known from previous information breach. Possible concern human relationship takeover	yes
DMX	Disposable Email	Email used is a disposable emails service	yes
IPR	IP Address Rotation	Same visitor is rotating its IP addresses	no
SHD	Suspicious Request Headers	Abnormal HTTP Request headers	yes
SUA	Suspicious User-Agent	User Agent non from a regular spider web browser	yes
PCX	Public Cloud Execution	IP address belongs to a populace cloud service similar AWS or GCP	no
IPD	IP/Country discrepancy	Country inferred from visitor IP is dissimilar from province land inward submitted request	no
SGE	Suscpicious Geolocation	This asking is non commonly received from this geolocation. Possible concern human relationship takeover.	no

Passive vs. Active

Passive mode
Quarantyne lets you lot create upward one's ask heed how you lot desire to have got requests it flags. Quarantyne's default configuration is to NOT block tainted traffic. This traffic volition brand its way to your server in addition to volition survive labelled equally such via HTTP headers.
Passive vogue is the recommended way to instruct familiar alongside Quarantyne in addition to to instruct a feel of what's going on within your spider web traffic. In your application, log or plot the incoming Quarantyne labels in addition to you lot mightiness survive surprised (or not) yesteryear what you lot find!

Active Mode
In active mode, Quarantyne prevents tainted traffic from reaching your application. Blocking happens entirely you lot configure explicitely Quarantyne to produce so. The configuration department explains how traffic blocking tin lavatory survive enabled.

Configuration
Two complementary configuration systems are used: command-line arguments in addition to an external (local or remote) JSON configuration file.

Command-line arguments
Run the next ascendance to display the assistance in addition to what arguments are available

$ coffee -jar quarantyne -h Usage: 
 [options]   Options:     --admin       internal ip:port where to access admin, UI in addition to metrics. Optional     --config-file       Optional URL or local path to a Quarantyne JSON configuration file     --egress       HTTP goal where Quarantyne forwards annotated spider web traffic.       Default: http://httpbin.org     --help, -help, --h, -h       Display assistance well-nigh available configuration arguments       Default: mistaken     --ingress       ip:port of inbound spider web traffic.       Default: 0.0.0.0:8080

The --config-file is an optional JSON configuration file that tells Quarantyne how requests to your service are structured. It enables deep traffic analysis in addition to increase coverage.

Traffic config JSON file
The traffic config file is optional in addition to tin lavatory either survive an absolute local path or a remote HTTP(S) URL to a JSON file containing a unmarried JSON object alongside the next structure. Describing the construction of your HTTP requests helps Quarantyne perform deep inspection of critical information such equally password, emails or countries.

{   "login_action": {     "path": "/anything",     "identifier_param": "email",     "secret_param": "password"   },   "register_action": {     "path": "/anything",     "identifier_param": "email",     "secret_param": "password"   },   "email_param_keys": ["email", "contact[email]"],   "country_iso_code_param_keys": ["country_code"],   "blocked_request_page": "https://raw.githubusercontent.com/AndiDittrich/HttpErrorPages/master/dist/HTTP500.html",   "blocked_classes": ["all"] }

Quarantyne is able to parse payloads submitted via POST/PUT alongside a Content-Type of application/json or application/x-www-form-urlencoded.
Root properties are optional.

Property	Definition	Notes
*_action	A POST/PUT information payload	login_action describes the information construction sent when logging in. register_action defines the information construction sent when registering / creating an account.
*_action.path	Path where information is submitted	Must kickoff yesteryear /
*_action.identifier_param	Form/JSON telephone substitution scream where the user identifier is sent
*_action.secret_param	Form/JSON telephone substitution where the user password is sent
email_param_keys	Form/JSON telephone substitution where e-mail addresses are sent
country_iso_code_param_keys	Form/JSON telephone substitution where province iso codes are sent
blocked_request_page	HTTP reply to furnish when blocking a request	It's amend when this looks similar a legit page/error equally to non tip off the attack. Even amend if you lot tin lavatory inject faux information :)
blocked_classes	An array of gear upward on classes to block.	[] is equivalent to passive mode. ['all'] stops every bird of gear upward on Quarantyne tin lavatory detect. See coverage

Quick run

Hosted demo
Available at https://demo.quarantyne.com/. In this scenario, Quarantyne is fronting httpbin.org inward passive mode. Threats in addition to misuse sent volition survive flagged via HTTP headers in addition to thence querying https://demo.quarantyne.com/headers or https://demo.quarantyne.com/anything is a expert kickoff to run across what's going on. Hint: kickoff simple, kickoff alongside curl.

Run the jar
Quarantyne ships equally a unmarried 0-dependencies executable jar. Download a liberate in addition to run:

$ coffee -jar quarantyne.jar

Build from source
Clone this repo or in addition to run the following

$ ./gradlew run

You should run across the following:

"2018-11-28T22:25:17.152-0800" [main] INFO com.quarantyne.proxy.Main - 0.0.0.0:8080 <= quarantyne => http://httpbin.org:80 "2018-11-28T22:25:17.223-0800" [main] INFO com.quarantyne.proxy.Main - run across available options alongside --help "2018-11-28T22:25:17.234-0800" [main] DEBUG com.quarantyne.proxy.Main - ==> final result loop size is 8 "2018-11-28T22:25:17.234-0800" [main] DEBUG com.quarantyne.proxy.Main - ==> detected iv cpus inwardness "2018-11-28T22:25:17.496-0800" [main] INFO com.quarantyne.config.ConfigRetrieverOptionsSupplier - remote configuration file flora at https://s3-us-west-2.amazonaws.com/releases.quarantyne.com/quarantyne.test.json

You are all set! By default, Quarantyne starts on 127.0.0.1:8080, in addition to proxies traffic to http://httpbin.org.
Send a few requests to http://127.0.0.1:8080/headers via diverse means. If fraudulent deportment is detected, you lot should run across X-Quarantyne-Label HTTP headers inward the asking have yesteryear your application. Hint: endeavor alongside curl.

Distributions

Heroku Buildpack
https://github.com/quarantyne/heroku-buildpack-quarantyne

Docker image
Coming soon

Mailing List
https://groups.google.com/forum/#!forum/quarantyne-users

License
Apache 2

Download Quarantyne