Che Ruisi-Besares CheRuisiBesares

CheRuisiBesares / block_ddos

Created August 28, 2016 20:38 — forked from guerrerocarlos/block_ddos

Blocking all ANY queries in DNS server to prevent DDOS DNS amplification attack

	iptables --flush
	iptables -A INPUT -p udp --dport 53 -m string --from 50 --algo bm --hex-string '\|0000FF0001\|' -m recent --set --name dnsanyquery
	iptables -A INPUT -p udp --dport 53 -m string --from 50 --algo bm --hex-string '\|0000FF0001\|' -m recent --name dnsanyquery --rcheck --seconds 60 --hitcount 1 -j DROP
	iptables -A INPUT -p udp --dport 53 -m u32 --u32 $(python generate-netfilter-u32-dns-rule.py --qname . --qtype ANY) -j DROP
	#iptables -A INPUT -p udp --dport 53 -m u32 --u32 $(python generate-netfilter-u32-dns-rule.py --qname isc.org --qtype ANY) -j DROP
	#iptables -A INPUT -p udp --dport 53 -m u32 --u32 $(python generate-netfilter-u32-dns-rule.py --qname isc.org. --qtype ANY) -j DROP
	iptables -A INPUT -p udp --dport 53 -m string --from 50 --algo bm --hex-string '\|0000FF0001\|' -j DROP
	#para bloquear ataque isc.org
	iptables -A INPUT -p udp -m string --hex-string "\|03697363036f726700\|" --algo bm --to 65535 -j DROP

CheRuisiBesares / dns_server.sh

Created March 24, 2017 00:19 — forked from iNarcissuss/dns_server.sh

Very basic DNS server written in bash

	#!/bin/bash
	#Based off of http://code.activestate.com/recipes/491264/
	if [ "$1" == "startserver" ]; then
	ncat -u -l 5355 -c $(readlink -f $0) -k
	exit
	fi
	timeout 1s cat /dev/stdin > input
	req=$(cat input \| xxd -p)

	#Functions from http://ubuntuforums.org/showthread.php?t=735140&p=4584216#post4584216