NAME
CGI::IDS - PerlIDS - Perl Website Intrusion Detection System (XSS, CSRF,
SQLI, LFI etc.)
VERSION
Version 1.0217 - based on and tested against the filter tests of PHPIDS
https://phpids.org rev. 1409
DESCRIPTION
PerlIDS (CGI::IDS) is a website intrusion detection system based on
PHPIDS https://phpids.org/ to detect possible attacks in website
requests, e.g. Cross-Site Scripting (XSS), Cross-Site Request Forgery
(CSRF), SQL Injections (SQLI) etc.
It parses any hashref for possible attacks, so it does not depend on
CGI.pm.
The intrusion detection is based on a set of converters that convert the
request according to common techniques that are used to hide attacks.
These converted strings are checked for attacks by running a filter set
of currently 68 regular expressions and a generic attack detector to
find obfuscated attacks. For easily keeping the filter set up-to-date,
PerlIDS is compatible to the original XML filter set of PHPIDS, which is
frequently updated.
Each matching regular expression has it's own impact value that
increases the tested string's total attack impact. Using these total
impacts, a threshold can be defined by the calling application to log
the suspicious requests to database and send out warnings via e-mail or
even SMS on high impacts that indicate critical attack activity. These
impacts can be summed per IP address, session or user to identify
attackers who are testing the website with small impact attacks over a
time.
You can improve the speed and the accurancy (reduce false positives) of
the IDS by specifying an XML whitelist file. This whitelist check can
also be processed separately by using CGI::IDS::Whitelist if you want to
pre-check the parameters on your application servers before you send
only the suspicious requests over to worker servers that do the complete
CGI::IDS check.
Download and install via CPAN:
http://search.cpan.org/dist/CGI-IDS/lib/CGI/IDS.pm
Report issues and contribute to PerlIDS on GitHub:
https://github.com/hinnerk-a/perlids
SYNOPSIS
use CGI;
use CGI::IDS;
$cgi = new CGI;
# instantiate the IDS object;
# do not scan keys, values only; don't scan PHP code injection filters (IDs 58,59,60);
# whitelist the parameters as per given XML whitelist file;
# All arguments are optional, 'my $ids = new CGI::IDS();' is also working correctly,
# loading the entire shipped filter set and not scanning the keys.
# See new() for all possible arguments.
my $ids = new CGI::IDS(
whitelist_file => '/home/hinnerk/ids/param_whitelist.xml',
disable_filters => [58,59,60],
);
# start detection
my %params = $cgi->Vars;
my $impact = $ids->detect_attacks( request => \%params );
if ($impact > 0) {
my_log( $ids->get_attacks() );
}
if ($impact > 30) {
my_warn_user();
my_email( $ids->get_attacks() );
}
if ($impact > 50) {
my_deactivate_user();
my_sms( $ids->get_attacks() );
}
# now with scanning the hash keys
$ids->set_scan_keys(scan_keys => 1);
$impact = $ids->detect_attacks( request => \%params );
See examples/demo.pl in CGI::IDS module package for a running demo.
You might want to build your own 'session impact counter' that increases
during multiple suspicious requests by one single user, session or IP
address.
METHODS
new()
Constructor. Can optionally take a hash of settings. If *filters_file*
is not given, the shipped filter set will be loaded, *scan_keys*
defaults to 0.
The filter set and whitelist will stay loaded during the lifetime of the
object. You may call `detect_attacks()' multiple times, the attack array
(`get_attacks()') will be emptied at the start of each run of
`detect_attacks()'.
For example, the following is a valid constructor:
my $ids = new CGI::IDS(
filters_file => '/home/hinnerk/ids/default_filter.xml',
whitelist_file => '/home/hinnerk/ids/param_whitelist.xml',
scan_keys => 0,
disable_filters => [58,59,60],
);
The Constructor dies (croaks) if no filter rule could be loaded.
detect_attacks()
DESCRIPTION
Parses a hashref (e.g. $query->Vars) for detection of possible attacks.
The attack array is emptied at the start of each run.
INPUT
+request hashref to be parsed
OUTPUT
Impact if filter matched, 0 otherwise
SYNOPSIS
$ids->detect_attacks(request => $query->Vars);
set_scan_keys()
DESCRIPTION
Sets key scanning option
INPUT
+scan_keys 1 to scan keys, 0 to switch off scanning keys, defaults to 0
OUTPUT
none
SYNOPSIS
$ids->set_scan_keys(scan_keys => 1);
get_attacks()
DESCRIPTION
Get an key/value/impact array of all detected attacks.
The array is emptied at the start of each run of C<detect_attacks()>.
INPUT
none
OUTPUT
ARRAY (
key => '',
value => '',
impact => n,
filters => (n, n, n, n, ...),
tags => ('', '', '', '', ...),
)
SYNOPSIS
$ids->get_attacks();
get_rule_description()
DESCRIPTION
Returns the rule description for a given rule id. This can be used for logging purposes.
INPUT
HASH
+ rule_id id of rule
OUTPUT
SCALAR description
EXAMPLE
$ids->get_rule_description( rule_id => $rule_id );
XML INPUT FILES
Filters
This module is compatible with the PHPIDS filter set. Please find the
latest (frequently updated) filter file from the PHPIDS Subversion
repository at
https://dev.itratos.de/projects/php-ids/repository/raw/trunk/lib/IDS/def
ault_filter.xml.
Example XML Code
<filters>
<filter>
<id>1</id>
<rule><![CDATA[(?:"+.*>)|(?:[^\w\s]\s*\/>)|(?:>")]]></rule>
<description>finds html breaking injections including whitespace attacks</description>
<tags>
<tag>xss</tag>
<tag>csrf</tag>
</tags>
<impact>4</impact>
</filter>
<filter>
<id>2</id>
<rule><![CDATA[(?:"+.*[<=]\s*"[^"]+")|(?:"\w+\s*=)|(?:>\w=\/)|(?:#.+\)["\s]*>)|(?:"\s*(?:src|style|on\w+)\s*=\s*")]]></rule>
<description>finds attribute breaking injections including whitespace attacks</description>
<tags>
<tag>xss</tag>
<tag>csrf</tag>
</tags>
<impact>4</impact>
</filter>
</filters>
Used XML Tags
* filters
The root tag.
* filter
Filter item.
* id
Filter ID for referring in log files etc.
* rule
The regular expression for detection of malicious code.
Case-insensitive; mode modifiers *i*, *m* and *s* in use.
* description
Description of what the filter finds.
* tags
Set of tags that describe the kind of attack.
* tag
Currently used values are *xss*, *csrf*, *sqli*, *dt*,
*id*, *lfi*, *rfe*, *spam*, *dos*.
* impact
Value of impact, defines the weight of the attack. Each
detection run adds the particular filter impacts to one
total impact sum.
Whitelist
Using a whitelist you can improve the speed and the accurancy (reduce
false positives) of the IDS. A whitelist defines which parameters do not
need to undergo the expensive scanning (if their values match given
rules and given conditions).
Example XML Code
<whitelist>
<param>
<key>scr_id</key>
<rule><![CDATA[(?:^[0-9]+\.[0-9a-f]+$)]]></rule>
</param>
<param>
<key>uid</key>
</param>
<param>
<key>json_value</key>
<encoding>json</encoding>
</param>
<param>
<key>login_password</key>
<conditions>
<condition>
<key>username</key>
<rule><![CDATA[(?:^[a-z]+$)]]></rule>
</condition>
<condition>
<key>send</key>
</condition>
<condition>
<key>action</key>
<rule><![CDATA[(?:^login$)]]></rule>
</condition>
</conditions>
</param>
<param>
<key>sender_id</key>
<rule><![CDATA[(?:[0-9]+\.[0-9a-f]+)]]></rule>
<conditions>
<condition>
<key>action</key>
<rule><![CDATA[(?:^message$)]]></rule>
</condition>
</conditions>
</param>
</whitelist>
Used XML Tags
* whitelist
The root tag.
* param
Parameter item. Defines the query parameter to be whitelisted.
* key
Parameter key.
* rule
Regular expression to match. If the parameter value matches
this rule or the rule tag is not present, the IDS will not
run its filters on it. Case-sensitive; mode modifiers *m*
and *s* in use.
* encoding
Use value *json* if the parameter contains JSON encoded
data. IDS will test the decoded data, otherwise a false
positive would occur due to the 'suspicious' JSON encoding
characters.
* conditions
Set of conditions to be fulfilled. This is the parameter
environment in which the whitelisted parameter has to live
in. The parameter will only be skipped if all conditions
(and its own parameter rule) match.
In the example XML this means: *login_password* may only be
skipped of filtering if parameter *action* equals *login*,
parameter *send* is present and parameter *username*
contains only small letters.
* condition
A condition to be fulfilled.
* key
Parameter key.
* rule
Regular expression to match. Missing `<rule>' means
*key has to be present no matter what content (can
even be empty)*.
Helper methods for building and improving whitelists
# check request
my $impact = $ids->detect_attacks( request => $request);
# print reasons and key/value pairs to a logfile for analysis of your application parameters.
print LOG "filtered_keys:\n"
foreach my $entry (@{$ids->{filtered_keys}}) {
print LOG "\t".$entry->{reason}."\t".$entry->{key}.' => '.$entry->{value}."\n";
}
print LOG "non_filtered_keys:\n"
foreach my $entry (@{$ids->{non_filtered_keys}}) {
print LOG "\t".$entry->{reason}."\t".$entry->{key}.' => '.$entry->{value}."\n";
}
`$entry->{reason}' returns following reasons for skipping and
non-skipping a value:
`$ids->{filtered_keys}'
* *key*: key not whitelisted
Filtered due to missing rule set for this key.
* *cond*: condition mismatch
Filtered due to mismatching conditions for this key.
* *rule*: rule mismatch
Filtered due to mismatching rule for this key.
* *enc*: value contains encoding
Filtered due to containing (JSON) encoding for this key.
`$ids->{non_filtered_keys}'
* *empty*: empty value
Not filtered due to empty value for this key.
* *harml*: harmless value
Not filtered due to harmless value string for this key.
* *key*: key generally whitelisted
Not filtered because the key has been generally whitelisted.
* *r&c*: rule & conditions matched
Not filtered due to matching rules and conditions for this key.
BUGS
Please report any bugs or feature requests to `bug-cgi-ids at
rt.cpan.org', or through the web interface at
http://rt.cpan.org/NoAuth/ReportBug.html?Queue=CGI-IDS. I will be
notified, and then you'll automatically be notified of progress on your
bug as I make changes.
SUPPORT
You can find documentation for this module with the perldoc command.
perldoc CGI::IDS
You can also look for information at:
* GitHub
https://github.com/hinnerk-a/perlids
* RT: CPAN's request tracker
http://rt.cpan.org/NoAuth/Bugs.html?Dist=CGI-IDS
* AnnoCPAN: Annotated CPAN documentation
http://annocpan.org/dist/CGI-IDS
* CPAN Ratings
http://cpanratings.perl.org/d/CGI-IDS
* Search CPAN
http://search.cpan.org/dist/CGI-IDS
CREDITS
Thanks to:
* Mario Heiderich (https://phpids.org/)
* Christian Matthies (https://phpids.org/)
* Ingo Bax (http://www.epublica.de/)
* epublica GmbH (http://www.epublica.de/)
* XING AG (https://www.xing.com/) for making this work possible and
running PerlIDS under heavy load for a long time.
AUTHOR
Hinnerk Altenburg, `<hinnerk at cpan.org>'
SEE ALSO
https://phpids.org/
COPYRIGHT & LICENSE
Copyright (C) 2008-2014 Hinnerk Altenburg
(http://www.hinnerk-altenburg.de/)
This file is part of PerlIDS.
PerlIDS is free software: you can redistribute it and/or modify it under
the terms of the GNU Lesser General Public License as published by the
Free Software Foundation, either version 3 of the License, or (at your
option) any later version.
PerlIDS is distributed in the hope that it will be useful, but WITHOUT
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public
License for more details.
You should have received a copy of the GNU Lesser General Public License
along with PerlIDS. If not, see <http://www.gnu.org/licenses/>.