+ +
+ + Snuffleupagus +
+
+
+
+ 
+
+
+ 
+
+
+
+
+
+
+
+
+
+
+
+ 
+
+
+ Key Features • + Download • + Examples • + Documentation • + License • + Thanks +
Snuffleupagus is a [PHP 7+](https://secure.php.net/) module designed to drastically raise the cost of attacks against websites, by killing entire bug @@ -14,4 +51,59 @@ classes. It also provides a powerful virtual-patching system, allowing administrator to fix specific vulnerabilities and audit suspicious behaviours without having to touch the PHP code. -You can read its documentation [here](https://snuffleupagus.readthedocs.io/). +## Key Features + +* Close to zero performance impact +* Powerful yet simple to write virtual-patching rules +* Killing several classes for vulnerabilities + * [Unserialize-based](https://www.owasp.org/images/9/9e/Utilizing-Code-Reuse-Or-Return-Oriented-Programming-In-PHP-Application-Exploits.pdf) code execution + * [`mail`-based]( https://blog.ripstech.com/2016/roundcube-command-execution-via-email/ ) code execution + * Cookie-stealing [XSS]( https://en.wikipedia.org/wiki/Cross-site_scripting ) + * File-upload based code execution + * Weak PRNG + * [XXE]( https://en.wikipedia.org/wiki/XML_external_entity_attack ) +* Hardening features + * Automatic `secure` and `samesite` flag for cookies + * Bundled set of rule to detect post-compromissions behaviours + * Global [strict mode]( https://secure.php.net/manual/en/migration70.new-features.php#migration70.new-features.scalar-type-declarations) + * Preventing writeable files execution + * Whitelist/blacklist for `eval` + * Request dumping capability + +## Download + +We've got a [download +page](https://snuffleupagus.readthedocs.io/download.html), where you can find +packages for your distribution, but you can of course just `git clone` this +repo, or check the releases on [github](https://github.com/nbs-system/snuffleupagus/releases). + +## Examples + +We're providing [various example rules](https://github.com/nbs-system/snuffleupagus/tree/master/config), +that are looking like this: + +```python +# Harden the `chmod` function +sp.disable_function.function("chmod").param("mode").value_r("^[0-9]{2}[67]$").drop(); + +# Mitigate command injection in `system` +sp.disable_function.function("system").param("command").value_r("[$|;&`\\n]").drop(); +``` + +Upon violation of a rule, you should see lines like this in your logs: + +```python +[snuffleupagus][0.0.0.0][disabled_function][drop] The execution has been aborted in /var/www/index.php:2, because the return value (0) of the function 'strpos' matched a rule. +``` + +## Documentation + +We've got a [comprehensive website](https://snuffleupagus.readthedocs.io/) with +all the documentation that you could possibly wish for. You can of course +[build it yourself](https://github.com/nbs-system/snuffleupagus/tree/master/doc). + +## Thanks + +Many thanks to the [Suhosin project](https://suhosin.org) for being a __huge__ +source of inspiration, and to all [our +contributors](https://github.com/nbs-system/snuffleupagus/graphs/contributors). -- cgit v1.3