loveshell/ngx_lua_waf
Ngx Lua Waf
ngx_lua_waf ist eine OpenResty-Web-Application-Firewall, die Lua verwendet, um bösartige HTTP-Anfragen zu filtern und Webangriffe zu blockieren. Sie fungiert als programmierbarer Request-Filter und IP-Zugriffskontroller für Nginx und bietet eine Sicherheitsebene zur Identifizierung und Blockierung unbefugter Scanner, Fuzzing-Versuche und abnormaler Netzwerkanfragen.
Das Projekt enthält Funktionen zur HTTP-Layer-7-DDoS-Mitigation durch Begrenzung der Anfragerate pro IP-Adresse. Es sichert die Umgebung weiter ab, indem der Zugriff auf sensible Archive eingeschränkt und die Skriptausführung in Upload-Verzeichnissen blockiert wird, um Datenabfluss zu verhindern.
Das System verwaltet die Sicherheit durch reguläre Ausdrucksmuster über URLs, Header, Cookies und POST-Bodys, um Bedrohungen wie SQL-Injection und XSS zu blockieren. Es bietet administrative Tools zur Verwaltung von IP-Whitelists und Blacklists, protokolliert Sicherheitsereignisse für Audits und synchronisiert Firewall-Regeln von einem Remote-Server.
Features
- NGINX Extensions - Implements security logic as a programmable extension within the Nginx request processing pipeline using Lua.
- Web Application Firewalls - Implements a web application firewall that protects services from SQL injection and XSS via real-time HTTP traffic inspection.
- Network Request Filters - Uses regular expression rules to inspect and block common web threats such as SQL injection and XSS.
- Programmable Request Filters - Provides a programmable Lua-based engine to scan HTTP headers and request bodies for malicious injection patterns.
- Regex Pattern Matching - Scans request headers and bodies against predefined regular expression rules to identify and block web attacks.
- Layer 7 Rate Limiters - Mitigates Layer 7 DDoS attacks by restricting the frequency of requests allowed from a single IP address.
- Access Control Lists - Controls network traffic by permitting or blocking requests based on defined IP white-lists and black-lists.
- IP Address Filtering - Filters network traffic by comparing client IP addresses against configured white-lists and black-lists.
- Denial of Service Prevention - Mitigates high-frequency stress testing and coordinated attacks by limiting the request rate per IP address.
- DoS Attack Defenses - Prevents server resource exhaustion by implementing defenses against flooding and DoS attack patterns.
- File Upload Security - Scans POST data and uploaded file extensions for malicious patterns to prevent injection and file-upload attacks.
- Payload Inspection - Analyzes request bodies and uploaded file extensions for malicious patterns to stop injection and file-upload threats.
- Malicious Traffic Blocking - Filters incoming network traffic to block unauthorized scanners, fuzzing attempts, and other malicious request patterns.
- Request Body Inspection - Inspects URLs, POST bodies, and cookies for malicious patterns to block abnormal network requests.
- Scanner Traffic Filtering - Inspects request methods, headers, and cookies to identify and block unauthorized scanners and malicious traffic.
- Web Attack Blocking - Filters incoming requests for common injection and fuzzing attempts using configurable regular expression rules.
- IP-Based Rate Limiting - Prevents denial of service attacks by restricting the number of requests allowed per IP address.
- Traffic Management - Controls traffic based on IP lists and concurrency limits to protect server resources from exhaustion.
- Remote Rule Synchronization - Updates firewall protection patterns by downloading and synchronizing new configuration files from a remote server.
- IP Allow/Deny Lists - Manages access to the server by permitting or blocking requests based on defined IP white-lists and black-lists.
- Path Access Restrictions - Blocks unauthorized access to sensitive archives and prevents script execution in specific directories.
- Sensitive File Protections - Blocks public web access to sensitive archives and prevents script execution in upload directories to prevent data leakage.
- Firewall Rule Synchronization - Synchronizes firewall security policies by downloading new rule files from a remote server.
