loveshell/ngx_lua_waf
Ngx Lua Waf
ngx_lua_waf este un firewall pentru aplicații web (WAF) OpenResty care utilizează Lua pentru a filtra cererile HTTP malițioase și a bloca atacurile web. Acționează ca un filtru de cereri programabil și controler de acces IP pentru Nginx, oferind un strat de securitate pentru a identifica și bloca scanerele neautorizate, tentativele de fuzzing și cererile de rețea anormale.
Proiectul include capabilități pentru atenuarea DDoS la nivelul 7 HTTP prin restricționarea frecvenței cererilor per adresă IP. Securizează mediul suplimentar prin restricționarea accesului la arhive sensibile și blocarea execuției de scripturi în directoarele de upload pentru a preveni scurgerile de date.
Sistemul gestionează securitatea prin potrivirea modelelor de expresii regulate (regex) în URL-uri, headere, cookie-uri și corpuri POST pentru a bloca amenințări precum SQL injection și XSS. Oferă instrumente administrative pentru gestionarea listelor albe și negre de IP-uri, logarea evenimentelor de securitate pentru audit și sincronizarea regulilor de firewall de la un server remote.
Features
- NGINX Extensions - Implements security logic as a programmable extension within the Nginx request processing pipeline using Lua.
- Web Application Firewalls - Implements a web application firewall that protects services from SQL injection and XSS via real-time HTTP traffic inspection.
- Network Request Filters - Uses regular expression rules to inspect and block common web threats such as SQL injection and XSS.
- Programmable Request Filters - Provides a programmable Lua-based engine to scan HTTP headers and request bodies for malicious injection patterns.
- Regex Pattern Matching - Scans request headers and bodies against predefined regular expression rules to identify and block web attacks.
- Layer 7 Rate Limiters - Mitigates Layer 7 DDoS attacks by restricting the frequency of requests allowed from a single IP address.
- Access Control Lists - Controls network traffic by permitting or blocking requests based on defined IP white-lists and black-lists.
- IP Address Filtering - Filters network traffic by comparing client IP addresses against configured white-lists and black-lists.
- Denial of Service Prevention - Mitigates high-frequency stress testing and coordinated attacks by limiting the request rate per IP address.
- DoS Attack Defenses - Prevents server resource exhaustion by implementing defenses against flooding and DoS attack patterns.
- File Upload Security - Scans POST data and uploaded file extensions for malicious patterns to prevent injection and file-upload attacks.
- Payload Inspection - Analyzes request bodies and uploaded file extensions for malicious patterns to stop injection and file-upload threats.
- Malicious Traffic Blocking - Filters incoming network traffic to block unauthorized scanners, fuzzing attempts, and other malicious request patterns.
- Request Body Inspection - Inspects URLs, POST bodies, and cookies for malicious patterns to block abnormal network requests.
- Scanner Traffic Filtering - Inspects request methods, headers, and cookies to identify and block unauthorized scanners and malicious traffic.
- Web Attack Blocking - Filters incoming requests for common injection and fuzzing attempts using configurable regular expression rules.
- IP-Based Rate Limiting - Prevents denial of service attacks by restricting the number of requests allowed per IP address.
- Traffic Management - Controls traffic based on IP lists and concurrency limits to protect server resources from exhaustion.
- Remote Rule Synchronization - Updates firewall protection patterns by downloading and synchronizing new configuration files from a remote server.
- IP Allow/Deny Lists - Manages access to the server by permitting or blocking requests based on defined IP white-lists and black-lists.
- Path Access Restrictions - Blocks unauthorized access to sensitive archives and prevents script execution in specific directories.
- Sensitive File Protections - Blocks public web access to sensitive archives and prevents script execution in upload directories to prevent data leakage.
- Firewall Rule Synchronization - Synchronizes firewall security policies by downloading new rule files from a remote server.
