Dirty Tricks: Using nginx and Lua to thwart bots and skript kiddies
summary
Implements a working Telnet CAPTCHA: an nginx stream module TCP proxy plus Lua generates simple math challenges, tracks attempts, allows two concurrent virtual modems, and drops connections that fail so Nmap and scanners cannot reach the 386 BBS; it successfully protects a retro BBS and a public site. Also demonstrates putting session IDs in DNS hostnames via TLS SNI host-based session IDs to avoid expensive TLS handshakes and reduce CPU under spikes (seen survival at ~90,000 hits).
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:44Retrocomputing meets work
- 3:28Old BBS on the internet
- 10:29Rediscovering computers
- 13:40Nginx and Lua for telnet BBS
- 17:33Lua and Nginx for web protection
- 21:06TLS handshake tricks
- 25:19Resource-saving techniques
- 27:06Resources and closing
- 28:39Q&A
related talks
48mHow to Thwart Malicious Automation and Kick Bot Butt for $0
01h 04mServer-Side Browsing Considered Harmful
01h 01mDrive-by SSL certificate creation with nginx
44mDigital Cat-and-Mouse: Strategies to Outsmart Scrapers, Phishers, and Thieves
20mUnderstanding and Mitigating Risks in LLM-Powered Web Apps
42mCracking the Code: Decoding Anti-Bot Systems!
45mHTTP Desync Attacks: Smashing Into The Cell Next Door
30mTales of Red Teaming