Parsnip by Carrotware (a NIPS tool)

Source code for Parsnip, ASP.Net 4.7.2

Welcome to the GitHub project for Carrotware's Parsnip, an open-source C# Network Intrusion Protection System (NIPS).

Overview

Parsnip is designed to protect Windows servers by automatically monitoring logs and feeds for malicious activity. When a "bad actor" is identified, Parsnip dynamically updates Windows Firewall rules to block the offending IP addresses.

Key Features

• Pluggable Architecture: Add new scanning capabilities simply by dropping a DLL into the application folder.
• Intelligent Thresholding: Configurable "cutoff" counts to prevent blocking legitimate users on single errors while catching persistent attackers.
• Firewall Optimization: Automatically manages rule limits by subdividing large block lists into multiple sub-rules (handling the ~1000 IP limit per scope).
• Long-Term Blocking: Includes logic to promote repeat offenders to a persistent long-term blacklist.
• Whitelisting: Built-in support to ensure critical IPs (like your own) are never accidentally blocked.

Included Modules

• WebLog (IIS): Scans IIS logs for common attack patterns (SQL injection, PHP exploits, suspicious User-Agents).
• MailLog: Monitors for mail server abuse (e.g., SmarterMail).
• FtpLog: Monitors Filezilla/FTP logs for brute-force attempts.
• EventLog: Scans Windows Event Logs (useful for RDP brute-force detection).
• BadActor: Consumes external threat intelligence feeds.

If you have found this tool useful please contact us.

Please note the terms of the MIT License: "The software is provided 'as is', without warranty of any kind, express or implied."

---

Module Development (Plugins)

Parsnip uses Reflection to discover scanning modules at runtime. You can create your own custom scanner by following these steps:

1. Create a Class Library: Create a new .NET Framework 4.7.2 project and reference Parsnip.Common.dll (or the .Net project).
2. Implement IProcessor: Create a class that implements the Parsnip.Common.IProcessor interface.
3. Define FetchResults():
   • Your module should perform its scanning logic (parsing a log file, querying a database, or fetching an API).
   • Return a ProcessorResult object containing the desired Firewall Rule name and a list of AddressBlockData (IP and expiration date).
4. Deployment: Compile your project and drop the DLL into the Parsnip executable directory. The FirewallProcessor will automatically detect and execute your module during the next run.

---

Developer Quick Start Guide

Copyright (c) 2023 Samantha Copeland C# code licensed under the MIT License https://opensource.org/license/mit Source code is available on GitHub

The parsnip icon is copyright (c) 1998, 2023 Samantha Copeland Image licensed under CC BY-NC-ND 4.0 Deed - https://creativecommons.org/licenses/by-nc-nd/4.0/deed.en Icon may be freely used within the application in an unaltered format even in a commercial setting.

Parsnip is maintained by Samantha Copeland

Install Development Tools

Visual Studio Community/Express/Pro/Enterprise (ISO CE 2015) Professional (or higher) editions OK. Typically being developed on VS 2015 Enterprise or VS 2022 Enterprise.

Get the Source Code

1. Go to the repository (GitHub) in a browser

2. Clone the GIT repository using your favorite GIT client

Open the Project

1. Start Visual Studio

2. Open Parsnip.sln solution in the root of the repository

Deployment Notes

• Privileges: As this application manages Windows Firewall rules via COM (HNetCfg.FwPolicy2), it must run with Administrative privileges.
• Scheduled Task: The recommended deployment is as a Windows Scheduled Task running every 5–15 minutes under the SYSTEM account.
• Safety First: Always update the whitelist settings before your first run to avoid blocking your own administrative IP(s).

Compiling the solution yields an EXE and several DLLs. You only need to deploy the Parsnip.exe, Parsnip.Common.dll, and the specific module DLLs (e.g., Parsnip.Module.WebLog.dll) you wish to use.