Server Attack Prevention Tool ~in development~

[NvrGnaStp]

**Update** Just to let people know this is still in development, so far completed a more thorough template and have begun coding it, at this point I have finished the service management and will be working on the rest now. Please note that the first release will NOT support 2 servers and the Server #2 group box will only be for future use. I did not hide it so you know what to expect from this.



Soooo I decided to make a program which will help simplify basically "bypassing" these attacks. I wont give much info out but I will provide a screenshot. This is not a permanent fix but as of now my server has been running for 21 hours without a single disconnect. I am literally just starting this project but should finish by tomorrow with a Beta version. I may or may not include an instructional video but will definitely release a typed guide. To get this program though I will not be ... publicly releasing it I guess you could say, but only to those who add me on skype and provide a small bit of information. The server you work for/own, why you made the server, and what type of server you have (balanced, unbalanced, 100% free, etc etc.)

Why? to keep the attacker from finding a counter.

My goal for this project is to make this program 100% automated by the time it is complete. Source code is open to anyone who qualifies to the above questions. Written in VB.NET, don't like it? Tough ****, rewrite it in your own language, this will provide you the method to do so... only a small portion of this program will be made manual but it will save the information on exit (provided you do not move the .exe after closing it.)

Spoiler

This is extremely template-only as of now, once the code is decently written to a working extent I will announce "release".

Yes this is probably something some of you are able to do on your own but this takes everything you need to do from 3-4 separate, painstaking jobs into 1 quick and easy, fluid interface. Also there are some of you who have no idea wtf they are doing.

Call it Spoon feeding if you wish, I call it helping others. If you have any negative comments on this then it just goes to show how low the fiesta ragezone community is.

I will be providing MD5 checksum, SHA1 and Virus Total scan results. Any requested security measures such as another type of scan will be made.

Regards, Snowfox.

 

[Delius]

Sounds great, good to see there is a quick response to the attacks.

 

[Gruntilda]

Changing ports doesn't prevent ****, just so you're aware.

 

[NvrGnaStp]

Changing ports doesn't prevent ****, just so you're aware.

Maybe not but the attacks stop for a period of time when you do. Although you can't just assume that is my method off of what you see. Regardless all I am trying to do is make this pricks job 100x harder by giving everyone a way to make his life hell. Why even comment like that when someone tries to do something nice and puts a lot of work into it?

I'm putting this tool before my server so sir, -------->|_|
(close the door on your way out.)

 

[d4xyjen]

for me this would be a software its still running on your host once you got ddosed or flooded can you still stop that? still best to get an external firewall

 

[NvrGnaStp]

for me this would be a software its still running on your host once you got ddosed or flooded can you still stop that? still best to get an external firewall

If you knew much about the fiesta community you would realize most attacks are not DDoS attacks but simple DoS attacks either run by a booter or someone using loic on their dedi. That is only from a single IP address. All it takes is software like commview to detect the attacker and get their IPv4 Address and counter it with your own booter/loic or if you actually do have the ability, your own botnet.

 

[Cyndaquil]

Thank you.

(Instead of double posting, edit ftw)
Wow a like from Lunerica... I feel special.

my pleasure - It's good to see someone actually remotely caring about others, and not just themselves.

 

[XxChrisxX211]

Wow. I am fairly impressed with this! Good work on this and i quite love the idea. It may not be a permanent solution but it's SOMETHING. Better than nothing at all. And i agree with you Lunerica~

 

[Delius]

Yea. It is definitely better then nothing.
Still not sure what the attacker's trying to achieve by doing this but all well, hopefully this tool helps to bring the crashes to a cease.

 

[Myth]

I know it's early stages, but what exactly is the outcome of this tool? To capture the source IP then allow counter-attacks? To capture the data in packets (similar to FiestaShark) for analysis? To manage your services (auto-restarts)? It's confusing based on a template with a few buttons and dozens of labels/text boxes, hopefully you also code it efficiently without thrashing everything within your main-form, make use of classes.

Best of luck though.

 

[Delius]

From what I got from talking to him; it will automatically change the ports and restart the services.

 

[NvrGnaStp]

I know it's early stages, but what exactly is the outcome of this tool? To capture the source IP then allow counter-attacks? To capture the data in packets (similar to FiestaShark) for analysis? To manage your services (auto-restarts)? It's confusing based on a template with a few buttons and dozens of labels/text boxes, hopefully you also code it efficiently without thrashing everything within your main-form, make use of classes.

Best of luck though.

Thank you for not replying with negative feedback, I guess it doesn't matter if I say how it works, because either way no matter how you look at it the attacker is going to have a hell of a time having to go back and find what port its using and eventually get sick of it, I don't know about you but I have a passion for Fiesta and I've been playing for about 7 years and I've been messing with the files for around 5 years. This is something I will not just let go. So, I will continue to fight this no matter what the attacks come to.

The tool is basically going to be used to automatically swap out the port in the config between a set of user-defined ports or using the default that will be provided. It is not so much as a solution as a way to cope and to keep the attacker on task at all times if he wants to keep the servers down.

Right now I am working on revising my entire interface to compact and simplify it to be only for this purpose. Only the Manager service will be controlled.

As for the code I am very, very new to this so it is going to be a bit sloppy, that is why I am providing the source, so others can improve it, but my overall goal is to make EVERYTHING this program does automatic... after clicking a button of course...

 

[fiestanerd69]

It's a very basic idea but as you say all you are doing is making a program to change the ports of the zone/world manager and then saving the serverinfo file. It will only take a minute for normal people to do this, I admit having to type it in and press a few buttons is quicker but if you are lazy, so much that you can't even open the serverinfo.txt file and edit the ports then restart the services (With the tools released only takes a click of a button) then you shouldn't be doing fiesta.

In fact if you open the serverinfo.txt and then just leave I open all you will have to do next time is edit the port then ctrl+s, restart and done. Also people have already been doing this and it doesn't seem to affect him in any way, if it's an automated process which it seems like then there honestly is no point in this tool. Besides writing a tool that will edit text isn't very complicated and shouldn't take too long.

I made one in a good 30 minutes and that's only because I am still learning vb.net and I am not so much experienced with streams and such yet but I will provide the source and the application itself. There are bat files and programs released on the forums to restart your server so you can also use those after you've changed the ports.

To view the content, you need to sign in or register

Easy peasy, and there honestly is no point to this but if u want to carry on, sure be my guest.

 

[Evildarkang]

Port changing wont help i did something constructive while it looks like it will it wont they are using a udp port to open and close the world server, i found out cause i have my firewall log everything thats how they're able to sense and attack the ports directly...not by anything else i found that a port in the list isn't used at all, and blocked it.

[EDIT] This is noticed because of i run more than one type of server, i run 8 or 9 of them... :/

 

[NvrGnaStp]

It's a very basic idea but as you say all you are doing is making a program to change the ports of the zone/world manager and then saving the serverinfo file. It will only take a minute for normal people to do this, I admit having to type it in and press a few buttons is quicker but if you are lazy, so much that you can't even open the serverinfo.txt file and edit the ports then restart the services (With the tools released only takes a click of a button) then you shouldn't be doing fiesta.

In fact if you open the serverinfo.txt and then just leave I open all you will have to do next time is edit the port then ctrl+s, restart and done. Also people have already been doing this and it doesn't seem to affect him in any way, if it's an automated process which it seems like then there honestly is no point in this tool. Besides writing a tool that will edit text isn't very complicated and shouldn't take too long.

Also correct me if I'm wrong but, if there is even a single extra character, anywhere in the config before the manager ports are, your port changer wont even work properly.

How about when you go to sleep or pass out and the attack happens? you cant do this in your sleep.

I made one in a good 30 minutes and that's only because I am still learning vb.net and I am not so much experienced with streams and such yet but I will provide the source and the application itself. There are bat files and programs released on the forums to restart your server so you can also use those after you've changed the ports.

To view the content, you need to sign in or register

Easy peasy, and there honestly is no point to this but if u want to carry on, sure be my guest.

Next time read instead of skim, I mentioned the whole point of this project was to completely automate the process, from service crash detection all the way to swapping the ports and starting it back up, yes changing the ports does help until they find the new ports you used, its better than nothing and makes them have to constantly find and change the port.

 

[fiestanerd69]

Next time read instead of skim, I mentioned the whole point of this project was to completely automate the process, from service crash detection all the way to swapping the ports and starting it back up, yes changing the ports does help until they find the new ports you used, its better than nothing and makes them have to constantly find and change the port.

I did read your post hence why I said what I said. Read my post again you obviously either misunderstood it or misread it. It will not affect the attacker in anyway, you are only assuming it will slow him down.

To sum up my previous post, you want to make the process of changing the ip faster, but it only takes 10 seconds to change ports yourself.

Also from your template you provided I assumed you were going to manually type the port.

My goal for this project is to make this program 100% automated by the time it is complete. Source code is open to anyone who qualifies to the above questions. Written in VB.NET, don't like it? Tough ****, rewrite it in your own language, this will provide you the method to do so... only a small portion of this program will be made manual but it will save the information on exit (provided you do not move the .exe after closing it.)

See the text in bold, henceforth my assumption/s.

 

[Kreeate]

Please try to stay on-topic guys and gals.
Infractions shall fly if not this happens.

Thanks.

 

[jeff972]

I did read your post hence why I said what I said. Read my post again you obviously either misunderstood it or misread it. It will not affect the attacker in anyway, you are only assuming it will slow him down.

To sum up my previous post, you want to make the process of changing the ip faster, but it only takes 10 seconds to change ports yourself.

Also from your template you provided I assumed you were going to manually type the port.



See the text in bold, henceforth my assumption/s.

loool according to what I've understood from his project a 100% automated one would be "working" like this :

widgets: 3 pushbutt... 1 lineedit(for a key).... 1 label (display the current value)

1. check if the said serviced is stop...
2. a srand to generate 4 digits unsigned int, save the file etc etc
3. run the service

# quite a basic algo. btw however it's named in vb.net : Don't use loop for the 1. but signals and slots.... well kinda obvious you woulda say.



so when I look at his "preview", i cant help wondering....

 

[Alsm97]

How do corrupt packets(byte arrays) look like? The ones that crash the world manager.

 

[Myth]

how do corrupt packets(byte arrays) look like? The ones that crash the world manager.

596f7564756d62