Fortify ::: Open-Source Hidden Service Protection (Rust, Reverse Proxies, Behavioral Routing)

/u/Yugong curious how long it takes him to bring down.

I'd guess the time for him to go online plus an additional 5 to 10 minutes.

In my opinion, he shouldn't even bother to answer though. Edit: maybe he should, see comment bellow. Vibe-coders are basically abusing time and energy from people having the skills they don't. They do a couple of prompts until they can achieve something looking remotely functional, then come on tforum to get free pentesting, hoping it will magically resolve everything they can't work out themselves. I'm betting nothing good will come from this, like nothing came from the 100 other vibe-coded projects before it. I don't have time to analyze further though. I mean, I do, but I certainly won't.

You found my script!

pgpfreak, leaving a little respect here, your contribution to the community is very much appreciated.

Regarding the service above, yes there is vibe coding, but i was a software developer long before vibe coding was even an idea.

In its current state it seems to handle fairly large attacks and keep existing sessions browsing with no problems, my main focus now is new sessions hitting the captcha/landing page.

So for that we serve a pool of cached/static landing/captcha pages - This is us attempting to absorb some attacks.

Fortify monitors session count per circuit and applies a govenor / hard limits

monitors for path enum, directory scans, etc etc - the usual suspects, these are our 'internal alerts' the system is checking sessions for.

My next sprint will be clustering multiple fortify nodes together to pool resources, route, and absorb.I also toying around with a queue based system and xmr transaction verification for a more 'easypass' route through (Still monitord but alternate route to the site.)

I do not believe Fortify is anywhere near ready for deployment on any live systems, its currently a work in progress, and the intent was meant for smaller more personal onion protection. Current tests I've thrown at it (my own shitty DDOS, some attacks from BHC and DKF totaling to a 65k-85k flood session. The result at the time were: existing sessions surviving but new sessions were unable to land and hit the captcha. I've made some changes and implemented the cached landing page hoping this increases the odds of new, real sessions passing the captcha to join.

Mirrors = PoW enabled / Vanguard backed .onions.

Mirrors path to a 'Node'

Node_Healthy = Reverse proxy to real .onion site. (.onion - Not PoW)

Node_Threat = Lives and dies on the VPS hosting Fortify. (.onion - Not PoW)

SessionABC123 Hit the mirror, mirror serves a cached captcha (Merkle’s Puzzles) > upon success > Node_Healthy

Now if SessionABC123 started port scanning/flooding/dirscaning/slowloris > Demoted to Node_Threat > Cached/Captcha page.

Pretty sure i need to make the threat nodes PoW to add even more 'Fight back' against threats.

I want to also cluster the systems together using wireguard so they can share information, resource pools like captcha caches, and decide which VPS /Fortify node to direct sessions to. - This is my next sprint.

I understand the fears over vibe coding, and i completely agree. I'm still releasing this, I still have 20+ years of software development, many of which were long before AI was introduced. I am still motivated to keep working on this. I know the system needs some work and some tuning, and my goal with this post was to help reveal some of that through testing.

Again, im no master developer, but i am extremely passionate over software development, it is a full time job of mine as well as a personal hobby, and I'm currently managing a few projects 8+ years in the clearnet space.

Thanks for the elaborate answer. As you understood, I've been somehow triggered by the vibe-coding reference, for the reasons I mentioned in my initial comment: the AI trend has led to an influx of projects/libraries by people with few, sometimes no understanding of their own work, draining the time and energy of tforum's community members. New markets especially. I've lost a couple of hours exploring this kind of repositories and it has been a very frustrating experience to say the least.

However, maybe I had the wrong impression about your proposal. Your comment is somehow more convincing than the initial post, as it gives the impression you actually went through the write-up, and that you may have some skills to bring to the table. I guess apologies are in order. I don't claim to be knowledgeable enough with networking to give a relevant opinion here, but I'm sure you'll get some feedback eventually.

One non-technical question though, would you mind elaborate on this:

Built in response to evolving EU/US cryptography legislation

I'm not sure I quite follow you here (about EU especially).

Thanks for the follow up.

Im still actively diving into this project, trying to decide on a direction to go next. Honestly at this point and time, save your self the trouble, let me spend some more time on this, and you will see this again in a few weeks / months, if you are still interested, check it out then. I completely get how much time digging into something can take and in my opinion, while 'Fortify' does have some strengths, its still lacking in some critical areas like ingress control, specifically this one area. < let me address this first.

Regarding the current captcha system in place, its a place holder, i do plan on spending some effort coming up with much better versions.

I plan to update this main post, or maybe some comments with any updates or things i notice.

Regarding the EU/US Crypto stuff, I genuinely do not spend any time checking a lot of news, but i have seen some talk about the EU having some issues with e2e-encryption and maybe some laws changing removing certain types of encryption so LE can access things easier. MY thinking.....we need to help make TOR a bit easier to exist on, whether your a small time blogger, or a whistleblower; can a very easy, simple to setup system be built and given out for free - for those people.

I've actually "updated" the main post. I'm the type of ADD that when i write things i tend to write the same thing two or three different ways, so i sometimes have AI help clean it up, and you were right, it wasnt a good writeup.

Regarding the EU/US Crypto stuff (...)

I guess you're referring to Chat Control, which was a recent attempt by the UE to backdoor E2EE chat apps, allegedly to fight drug trafficking. It wasn't the first time that was suggested and it didn't go through for the same reasons as previously. You can't trust the state to respect privacy once this kind of law exist and moreover, trained criminals will find a way to bypass it regardless (and yes, I'm shilling about PGP, like always). Quite ironically, mass surveillance going nuts in the US right now (with the ICE stuff) is probably going to enforce EU public opinion even more against these kind of attempts to limit privacy.

Sounds you're a little bit confused about the rest though. While there is some heavy regulation going on with crypto, that's not so much a technical issue, than a legal one (non-KYC exchanges are basically forbidden here). As for Tor, if you want to help, just run a node. It's perfectly legal and even encouraged, mostly by non-government actors, but still. I wouldn't think it will change anytime soon. Even if it did, I'm not sure how your proposal would help, but once again, I may missing some necessary skills here.

Sorry, i used Crypto in the sense of Cryptography and not related to currencies. OH man, i hate continuing this conversation because i really am only partially informed. but here was where i connect the dots. If the clearnet is getting rid of encryption, and services can no longer offer it with there service....then TOR is a place those services can exist. I know its not a clear A..b...c rationale but it did trigger some inspiration for me. I know each item doesnt correlate directly, but, with the way things are going it never hurts to help grow the onion network.

Same system can be applied with couple lines of code at web application level, sending the banned cookies upstream. No point in it at all it's rediscovering fire in 2026. With vibe coding as /u/pgpfreak said only hallucinated code can be expected as much of this is.

What OP /u/Nessy doesn't understand is the limit isn't handling of requests. That's the easiest and most basic thing to do for experienced administrator. Where performance or skill bottoms out, scaling comes into effect. As Endgame gives option to either apply skill or spend on scaling to compensate lack of skill. Vibe coded software will never compete in performance with optimized enterprise ready software like Nginx.

It's the Tor network for majority if not all admins. Ways around it exist but handling the requests isn't one. Nginx can handle millions of requests if set up correct. Endgame already provides good starting configuration.

You have killed Fortify with your comment. I'll be back with something better.