PHP Web Application Firewall: Block malicious requests using a white list

Recommend this page to a friend!
     
  Info   View files Documentation   View files View files (82)   DownloadInstall with Composer Download .zip   Reputation   Support forum (6)   Blog (1)    
Ratings Unique User Downloads Download Rankings
StarStarStarStar 79%Total: 646 This week: 2All time: 4,914 This week: 100Up
Version License PHP version Categories
web-app-firewall 30Custom (specified...5HTTP, PHP 5, Security
Description Author

This package can block malicious requests using a white list.

It alters the .htaccess file to make requests for PHP pages go through a filter script that acts like a reverse proxy to implement a Web application framework (WAF).

The filter script will block requests of unauthorized format but the package provides a Web interface for the administrator white list requests of expected formats for the current Web application.

Innovation Award
PHP Programming Innovation award winner
October 2016
Winner

Prize: One big elePHPant Plush Mascott		 Some security attacks are performed by sending requests to Web servers that it is not expected to handle.

One way to minimize the chances of these attacks happening is to use a Web application firewall (WAF).

This package implements a Web Application Firewall in PHP for Web servers that support htaccess configuration.

It alters the .htaccess file so requests are handled by a script of this framework. It keeps track of a white list of request URLs supported by your application, so only approved URL formats are allowed.

URLs with unknown formats are put in moderation, so an administrator can approve the URLs or not for future requests.

This way the application can be protected from types of requests meant to perform security exploits.

Manuel Lemos
Picture of Roman Shneer
  Performance   Level  

Level 3 StarStarStar

 Innovation award
Innovation award
Nominee: 1x

Winner: 1x

 

Details

Web App Firewall

Introduction

WAFs goal is protect sites against hackers and virus attacks. Web App Firewall its PHP application that implement principle of reverse-proxy , control of types variables accepted by server , and comfortable management interface.<br> alt tag<br> W.A.F. supported to work under LAMP servers with .htaccess files support. Security protection based on white-list strategy: after starting "Learn" mode program collect map of requests, and user have to approve requests. After starting "Guard" mode - program accept only known requests.

Program using white-list strategy, it is more absolute protection, but its requires a lot of work on configuration. In the program using Intellectual graphical UI , its give an opportunity regularize most chaotic structure.

Contains libraries:<br>

Jquery-connections https://github.com/musclesoft/jquery-connections<br> jQuery-1.11.3 https://jquery.com<br> Google Charts https://developers.google.com/chart/<br>

Requires:<br>

Linux OS, Apache webserver with support htaccess and mod_rewrite,PHP5 with support CURL and MySQL<br>

How its working?

Web App Firewall organize reverse-proxy by injection to .htaccess file, and writing Rewrite Rules with security key 1.

WAF script get redirected request and parse path and parameters sent from user. Detect created rules for specified situation and block or accept request via prepared politics.

If request approved, WAF script sending request back to server via CURL with added security key 2 (.htaccess rule miss request if detect key2). If request blocked, WAF save logs and show 404 page. <img src="https://github.com/shaman33/web_app_firewall/blob/master/assets/imgs/scratch/reverse_proxy.png?raw=true">

Getting Started

Installation

HTACCESS Injection

Configuration Settings

Set W.A.F Status Learn on, and Guard off. Now program start collect request-map from every request to site, leave it for one week for view more complete structure of site.

Access Map - configuration permissions

Bad Requests log

Blacklist IP

Analizing Attacks

Support

Project Facebook<br> Write me for help RomanShneer@gmail.com<br> Please donate: <a href="https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=ECZBTKBD7T6A8"><img src="https://www.paypalobjects.com/en_US/i/btn/btn_donate_SM.gif"></a>

  Files folder image Files  
File Role Description
Files folder imageassets (3 directories)
Files folder imageinc (2 files)
Files folder imageinclude (2 files)
Files folder imagelibs (5 files)
Files folder imagesessions (1 file)
Accessible without login Plain text file .htaccess Data use SetEnv flag for testing
Accessible without login HTML file 404.html Doc. Documentation
Accessible without login Plain text file 404.php Example Example script
Plain text file ajax.php Class Class source
Accessible without login Plain text file blacklist.php Example Example script
Accessible without login Plain text file CONTRIBUTING.md Data Auxiliary data
Accessible without login Plain text file COPYING Data Auxiliary data
Accessible without login Plain text file edituser.php Example Example script
Accessible without login Plain text file exit.php Aux. Auxiliary script
Accessible without login Plain text file htaccess.php Example Example script
Accessible without login Plain text file index.php Example Example script
Accessible without login Plain text file install.php Example Example script
Accessible without login Plain text file installed.php Example Example script
Accessible without login Plain text file LICENSE Lic. License text
Accessible without login Plain text file login.php Example Example script
Accessible without login Plain text file logs.php Example Example script
Accessible without login Plain text file map.php Example Example script
Accessible without login Plain text file password.php Example Example script
Accessible without login Plain text file README.md Doc. Documentation
Accessible without login Plain text file remind_password.php Example Example script
Accessible without login Plain text file reset_password.php Example Example script
Accessible without login Plain text file settings.php Example Example script
Accessible without login Plain text file users.php Example Example script
Plain text file waf.php Class Class source

Downloadweb-app-firewall-2019-01-08.zip 1236KB
Downloadweb-app-firewall-2019-01-08.tar.gz 1420KB
Install with ComposerInstall with Composer
 Version Control Unique User Downloads Download Rankings  
 97%
Total:646
This week:2
All time:4,914
This week:100Up
User Ratings User Comments (1)
 All time
Utility:100%StarStarStarStarStarStar
Consistency:100%StarStarStarStarStarStar
Documentation:100%StarStarStarStarStarStar
Examples:91%StarStarStarStarStar
Tests:-
Videos:-
Overall:79%StarStarStarStar
Rank:39
 
very very good
5 years ago (muabshir)		80%StarStarStarStarStar
 

  Applications that use this package  
Protected by WebAppFirewall
This is site protected by WebAppFirewall

Add link image If you know an application of this package, send a message to the author to add a link here.


For more information send a message to info at phpclasses dot org.