之前我配置了libinjection
.so到防火墙上，现在修改我发给你的代码，将modsecurity配置到防火墙上
app
.py:
from flask import Flask, request,
jsonify
import ctypes
import numpy as np
from tensorflow
.keras
.models import load_model
from tensorflow
.keras
.preprocessing
.sequence import pad_sequences
import pickle
import
json
from urllib
.parse import unquote
import html
import sys
import base64
import re
from utils
.makelog import log_detection
import os
import logging
from logging
.handlers import RotatingFileHandler
os
.environ['TF_KERAS'] = '1'
os
.environ['TF_CPP_MIN_LOG_LEVEL'] = '2' # 1=警告，2=错误，3=静默
os
.environ['TF_ENABLE_ONEDNN_OPTS'] = '0' # 关闭 oneDNN 提示
app = Flask(__name__)
log_dir = os
.path
.join(os
.path
.dirname(os
.path
.abspath(__file__)), 'utils')
os
.makedirs(log_dir, exist_ok=True)
# 配置文件日志处理器（10MB轮换，保留10个备份）
file_handler = RotatingFileHandler(
os
.path
.join(log_dir, 'app
.log'),
maxBytes=10*1024*1024,
backupCount=10
)
file_handler
.setFormatter(logging
.Formatter(
'%(asctime)s - %(name)s - %(levelname)s - %(message)s'
))
# 设置日志级别（DEBUG/INFO/WARNING/ERROR/CRITICAL）
app
.logger
.setLevel(logging
.INFO)
file_handler
.setLevel(logging
.INFO)
app
.logger
.addHandler(file_handler)
# --- 加载 libinjection ---
try:
libinjection = ctypes
.CDLL('/usr/local/lib/libinjection
.so', mode=ctypes
.RTLD_GLOBAL)
libinjection
.libinjection_sqli
.argtypes = [
ctypes
.c_char_p,
ctypes
.c_size_t,
ctypes
.c_char_p,
ctypes
.c_size_t
]
libinjection
.libinjection_sqli
.restype = ctypes
.c_int
app
.logger
.info("Libinjection 加载成功")
print("Libinjection 加载成功（控制台输出）")
except Exception as e:
app
.logger
.error(f"Libinjection 加载失败: {str(e)}", exc_info=True)
exit(1)
# --- 解码辅助函数 ---
def try_base64_decode(s):
try:
if len(s) % 4 != 0:
return s
decoded = base64
.b64decode(s)
.decode('utf-8', errors='ignore')
if all(32 <= ord(c) <= 126 or c in '\t\r\n' for c in decoded):
return decoded
return s
except Exception:
return s
def deep_url_decode(s, max_depth=3):
decoded = s
for _ in range(max_depth):
new_decoded = unquote(decoded)
if new_decoded == decoded:
break
decoded = new_decoded
return decoded
# --- 提取 HTTP 请求中的潜在 SQL 内容 ---
def extract_sql_candidates(data):
candidates = []
def extract_strings(obj):
EXCLUDED_KEYS = {'uri', 'path', 'security', '
PHPSESSID', 'session_id','Login', 'login', 'submit', 'Submit'}
STATIC_RESOURCES = {'
.css', '
.js', '
.png', '
.jpg', '
.jpeg', '
.gif', '
.ico', '
.woff', '
.woff2'}
if isinstance(obj, dict):
for key, value in obj
.items
():
if key in EXCLUDED_KEYS:
continue
# 检查值是否为静态资源（无需检测）
if isinstance(value, str) and any(ext in value
.lower
() for ext in STATIC_RESOURCES):
continue
extract_strings(value) # 递归调用，仅传递值
elif isinstance(obj, list):
for item in obj:
extract_strings(item)
elif isinstance(obj, str):
text = obj
# 多层 URL 解码
text = deep_url_decode(text)
# HTML 实体解码
text = html
.unescape(text)
# Unicode 转义解码
try:
text = text
.encode
().decode('unicode_escape')
except Exception:
pass
# Base64 解码
text = try_base64_decode(text)
if len(text) < 1000:
candidates
.append(text)
extract_strings(data)
return candidates
# --- 检测逻辑 ---
def detect_one(query):
if re
.match(r'^\/
.*\
.(
php|html|
js)$', query):
return {
"检测结果": "正常",
"检测方式": "URI过滤",
"可信度": 1
.0
}
result_buf = ctypes
.create_string_buffer(8)
is_libi_sqli = libinjection
.libinjection_sqli(query
.encode('utf-8'), len(query),result_buf,ctypes
.sizeof(result_buf))
if is_libi_sqli:
return {
"检测结果": "存在SQL注入",
"检测方式": "Libinjection",
}
else:
return {
"检测结果": "正常",
"检测方式": "Libinjection",
}
@app
.route('/')
def home
():
return "SQL 注入检测系统已启动"
@app
.route('/detect', methods=['POST'])
def detect
():
app
.logger
.info(f"接收到请求: {request
.json}")
try:
data = request
.get_
json
()
if not data:
return
jsonify({"error": "缺少
JSON 请求体"}), 400
ip = request
.remote_addr
candidates = extract_sql_candidates(data)
results = []
for query in candidates:
result = detect_one(query)
log_detection(ip, query, result)
results
.append(result)
return
jsonify({"detections": results})
except Exception as e:
return
jsonify({"error": f"检测过程中发生错误: {str(e)}"}), 500
if __name__ == '__main__':
app
.run(host='0
.0
.0
.0', port=5000, debug=True)
nainx
.conf:
# 全局作用域（仅保留一份）
user user;
worker_processes 1;
events {
worker_connections 1024;
}
http {
lua_package_path "/usr/local/openresty/lualib/?
.lua;;";
include mime
.types;
default_type text/html;
sendfile on;
keepalive_timeout 65;
server {
listen 80;
server_name 10
.18
.47
.200;
location /dvwa {
rewrite_by_lua_file /usr/local/openresty/lualib/parse
.lua;
proxy_pass http://192
.168
.159
.100/DVWA-master/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_redirect http://10
.18
.47
.200/DVWA-master/ http://10
.18
.47
.200/dvwa/;
}
error_page 500 502 503 504 /50x
.html;
location = /50x
.html {
root html;
charset utf-8;
}
#屏蔽图标
location = /favicon
.ico {
access_log off;
log_not_found off;
}
}
}
parse
.lua:
local c
json = require "c
json
.safe"
local http = require "resty
.http"
-- 1) 解析 Nginx 内置变量和 Headers
local method = ngx
.req
.get_method
()
local uri = ngx
.var
.request_uri
local headers = {
user_agent = ngx
.var
.http_user_agent or "",
cookie = ngx
.var
.http_cookie or "",
host = ngx
.var
.http_host or "",
content_type = ngx
.var
.http_content_type or ""
}
-- 2) 解析 GET 参数
ngx
.req
.read_body
() -- 必须先读取 body，否则取不到 POST
local args = ngx
.req
.get_uri_args
()
local query_params = {}
for k, v in pairs(args) do
query_params[k] = v
end
-- 3) 解析 POST 数据: 根据 content_type 判断
JSON或
表单
local post_data = {}
if headers
.content_type and string
.find(headers
.content_type, "application/
json") then
local body_data = ngx
.req
.get_body_data
()
if body_data then
local
json_data = c
json
.decode(body_data)
if
json_data then
post_data =
json_data
else
ngx
.log(ngx
.ERR, "
JSON 解析失败")
end
end
else
local post_args = ngx
.req
.get_post_args
()
for k, v in pairs(post_args) do
post_data[k] = v
end
end
-- 4) 整合请求数据并日志输出
local request_data = {
method = method,
uri = uri,
headers = headers,
query_params = query_params,
post_data = post_data,
client_ip = ngx
.var
.remote_addr
}
ngx
.log(ngx
.ERR, "OpenResty 解析的数据: "
.. c
json
.encode(request_data))
-- 5) 调用 Flask WAF 后端
local httpc = http
.new
()
local res, err = httpc:request_uri("http://127
.0
.0
.1:5000/detect", {
method = "POST",
body = c
json
.encode(request_data),
headers = {
["Content-Type"] = "application/
json"
}
})
if not res then
ngx
.log(ngx
.ERR, "Flask WAF 请求失败: ", err)
ngx
.status = 500
ngx
.header["Content-Type"] = "text/html; charset=utf-8"
ngx
.say("WAF 检测异常")
return ngx
.exit(500)
end
-- 6) 复用连接
local ok, err_keep = httpc:set_keepalive(60000, 100)
if not ok then
ngx
.log(ngx
.ERR, "设置 keepalive 失败: ", err_keep)
end
ngx
.log(ngx
.ERR, "Flask 返回: ", res
.body)
-- 7) 解析Flask响应并处理（修正pcall返回值）
if res
.status ~= 200 then
ngx
.log(ngx
.ERR, "Flask 返回非200状态码: ", res
.status)
ngx
.status = 500
ngx
.header["Content-Type"] = "text/html; charset=utf-8"
ngx
.say("Flask 服务异常")
return ngx
.exit(500)
end
local success, decoded_data = pcall(c
json
.decode, res
.body)
if not success then
ngx
.log(ngx
.ERR, "Flask 响应
JSON解析失败: ", decoded_data)
ngx
.status = 500
ngx
.header["Content-Type"] = "text/html; charset=utf-8"
ngx
.say("WAF 响应格式错误")
return ngx
.exit(500)
end
local waf_result = decoded_data
-- 8) 判断是否存在SQL注入（根据app
.py的响应结构）
local is_sqli = false
local detections = waf_result
.detections or {}
for i = 1, #detections do
local detection = detections[i]
-- 检查检测结果是否为表类型且包含检测结果字段
if type(detection) == "table" and detection["检测结果"] then
if detection["检测结果"] == "存在SQL注入" then
is_sqli = true
break
end
end
end
-- for _, detection in ipairs(waf_result
.detections or {}) do
-- if detection["检测结果"] == "存在SQL注入" then
-- is_sqli = true
-- break
-- end
-- end
-- 9) 根据检测结果决定是否拦截
if is_sqli then
ngx
.log(ngx
.ERR, "WAF阻断 SQL注入")
ngx
.status = ngx
.HTTP_FORBIDDEN
ngx
.header["Content-Type"] = "text/html; charset=utf-8"
ngx
.say([[
<!DOCTYPE html>
<html lang="zh">
<head>
<meta charset="utf-8"/>
<title>访问受限</title>
<style>
/* 全局样式重置 */
* {
margin: 0;
padding: 0;
box-sizing: border-box;
}
body {
display: flex;
justify-content: center;
align-items: center;
min-height: 100vh;
background-color: #000;
color: #fff;
font-family: "Microsoft YaHei", Arial, sans-serif;
}
.container {
width: 90%;
max-width: 600px;
padding: 40px;
text-align: center;
border: 1px solid rgba(255, 255, 255, 0
.1);
border-radius: 8px;
background: rgba(10, 10, 10, 0
.8);
backdrop-filter: blur(5px);
box-shadow: 0 0 15px rgba(255, 255, 255, 0
.05);
}
h1 {
margin-bottom: 20px;
font-size: 2
.5rem;
letter-spacing: 2px;
color: #fff;
text-shadow: 0 0 10px rgba(0, 255, 255, 0
.5);
}
p {
margin-bottom: 30px;
font-size: 1
.1rem;
line-height: 1
.8;
color: rgba(255, 255, 255, 0
.9);
}
.btn-
back {
display: inline-block;
padding: 12px 30px;
background: transparent;
color: #00ffcc;
border: 1px solid #00ffcc;
border-radius: 4px;
font-size: 1rem;
font-weight: bold;
text-decoration: none;
transition: all 0
.3s ease;
cursor: pointer;
}
.btn-
back:hover {
background: rgba(0, 255, 204, 0
.1);
box-shadow: 0 0 15px rgba(0, 255, 204, 0
.3);
transform: translateY(-2px);
}
</style>
</head>
<body>
<div class="container">
<h1>访问受限</h1>
<p>
检测到疑似SQL注入/跨站脚本攻击(XXS)的恶意行为特征，<br/>
为保障系统安全，本次请求未被授权执行<br/>
</p>
<a href="javascript:void(0)" class="btn-
back" id="
backBtn">返回上一页</a>
</div>
<script>
// 点击按钮返回前一个页面状态
document
.getElementById('
backBtn')
.addEventListener('click', function
() {
history.back();
});
</script>
</body>
]])
else
ngx
.log(ngx
.ERR, "WAF 判断正常，放行请求")
return -- 关键：放行请求，继续执行proxy_pass
end
本文介绍了一种使用PHP和JS实现的延迟跳转技术，有效解决了页面跳转时的表单刷新问题，避免了回退时的表单重复提交。通过设置定时器或HTTP头Refresh属性，实现了页面的平滑过渡。
扫一扫
182
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
