之前我配置了libinjection
.so到防火墙上，现在修改我发给你的代码，将modsecurity配置到防火墙上
app
.py:
from flask import Flask, request, jsonify
import ctypes
import numpy as np
from tensorflow
.keras
.models import load_model
from tensorflow
.keras
.preprocessing
.sequence import pad_sequences
import pickle
import json
from urllib
.parse import unquote
import html
import sys
import base64
import re
from utils
.makelog import log_detection
import os
import logging
from logging
.handlers import RotatingFileHandler
os
.environ['TF_KERAS'] = '1'
os
.environ['TF_CPP_MIN_LOG_LEVEL'] = '2' # 1=警告，2=错误，3=静默
os
.environ['TF_ENABLE_ONEDNN_OPTS'] = '0' # 关闭 oneDNN 提示
app = Flask
(__name__
)
log_dir = os
.path
.join
(os
.path
.dirname
(os
.path
.abspath
(__file__
)), 'utils'
)
os
.makedirs
(log_dir, exist_ok=True
)
# 配置文件日志处理器（10MB轮换，保留10个备份）
file_handler = RotatingFileHandler
(
os
.path
.join
(log_dir, 'app
.log'
),
maxBytes=10*1024*1024,
backupCount=10
)
file_handler
.setFormatter
(logging
.Formatter
(
'%
(asctime
)s - %
(name
)s - %
(levelname
)s - %
(message
)s'
))
# 设置日志级别（DEBUG/INFO/WARNING/ERROR/CRITICAL）
app
.logger
.setLevel
(logging
.INFO
)
file_handler
.setLevel
(logging
.INFO
)
app
.logger
.addHandler
(file_handler
)
# --- 加载 libinjection ---
try:
libinjection = ctypes
.CDLL
('/usr/local/lib/libinjection
.so', mode=ctypes
.RTLD_GLOBAL
)
libinjection
.libinjection_sqli
.argtypes = [
ctypes
.c_char_p,
ctypes
.c_size_t,
ctypes
.c_char_p,
ctypes
.c_size_t
]
libinjection
.libinjection_sqli
.restype = ctypes
.c_int
app
.logger
.info
("Libinjection 加载成功"
)
print
("Libinjection 加载成功（控制台输出）"
)
except Exception as e:
app
.logger
.error
(f"Libinjection 加载失败: {str
(e
)}", exc_info=True
)
exit
(1
)
# --- 解码辅助函数 ---
def try_base64_decode
(s
):
try:
if len
(s
) % 4 != 0:
return s
decoded = base64
.b64decode
(s
).decode
('utf-8', errors='ignore'
)
if all
(32 <= ord
(c
) <= 126 or c in '\t\r\n' for c in decoded
):
return decoded
return s
except Exception:
return s
def deep_url_decode
(s, max_depth=3
):
decoded = s
for _ in range
(max_depth
):
new_decoded = unquote
(decoded
)
if new_decoded == decoded:
break
decoded = new_decoded
return decoded
# --- 提取 HTTP 请求中的潜在 SQL 内容 ---
def extract_sql_candidates
(data
):
candidates = []
def extract_strings
(obj
):
EXCLUDED_KEYS = {'uri', 'path', 'security', 'PHPSESSID', 'session_id','Login', 'login', 'submit', 'Submit'}
STATIC_RESOURCES = {'
.css', '
.js', '
.png', '
.jpg', '
.jpeg', '
.gif', '
.ico', '
.woff', '
.woff2'}
if isinstance
(obj, dict
):
for key, value in obj
.items
():
if key in EXCLUDED_KEYS:
continue
# 检查值是否为静态资源（无需检测）
if isinstance
(value, str
) and any
(ext in value
.lower
() for ext in STATIC_RESOURCES
):
continue
extract_strings
(value
) # 递归调用，仅传递值
elif isinstance
(obj, list
):
for item in obj:
extract_strings
(item
)
elif isinstance
(obj, str
):
text = obj
# 多层 URL 解码
text = deep_url_decode
(text
)
# HTML 实体解码
text = html
.unescape
(text
)
# Unicode 转义解码
try:
text = text
.encode
().decode
('unicode_escape'
)
except Exception:
pass
# Base64 解码
text = try_base64_decode
(text
)
if len
(text
) < 1000:
candidates
.append
(text
)
extract_strings
(data
)
return candidates
# --- 检测逻辑 ---
def detect_one
(query
):
if re
.match
(r'^\/
.*\
.(php|html|js
)$', query
):
return {
"检测结果": "正常",
"检测方式": "URI过滤",
"可信度": 1
.0
}
result_buf = ctypes
.create_string_buffer
(8
)
is_libi_sqli = libinjection
.libinjection_sqli
(query
.encode
('utf-8'
), len
(query
),result_buf,ctypes
.sizeof
(result_buf
))
if is_libi_sqli:
return {
"检测结果": "存在SQL注入",
"检测方式": "Libinjection",
}
else:
return {
"检测结果": "正常",
"检测方式": "Libinjection",
}
@app
.route
('/'
)
def home
():
return "SQL 注入检测系统已启动"
@app
.route
('/detect', methods=['POST']
)
def detect
():
app
.logger
.info
(f"接收到请求: {request
.json}"
)
try:
data = request
.get_json
()
if
not data:
return jsonify
({"error": "缺少 JSON 请求体"}
), 400
ip = request
.remote_addr
candidates = extract_sql_candidates
(data
)
results = []
for query in candidates:
result = detect_one
(query
)
log_detection
(ip, query, result
)
results
.append
(result
)
return jsonify
({"detections": results}
)
except Exception as e:
return jsonify
({"error": f"检测过程中发生错误: {str
(e
)}"}
), 500
if __name__ == '__main__':
app
.run
(host='0
.0
.0
.0', port=5000, debug=True
)
nainx
.conf:
# 全局作用域（仅保留一份）
user user;
worker_processes 1;
events {
worker_connections 1024;
}
http {
lua_package_path "/usr/local/openresty/lualib/?
.lua;;";
include mime
.types;
default_type text/html;
sendfile on;
keepalive_timeout 65;
server {
listen 80;
server_name 10
.18
.47
.200;
location /dvwa {
rewrite_by_lua_file /usr/local/openresty/lualib/parse
.lua;
proxy_pass http://192
.168
.159
.100/DVWA-master/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_redirect http://10
.18
.47
.200/DVWA-master/ http://10
.18
.47
.200/dvwa/;
}
error_page 500 502 503 504 /50x
.html;
location = /50x
.html {
root html;
charset utf-8;
}
#屏蔽图标
location = /favicon
.ico {
access_log off;
log_
not_
found off;
}
}
}
parse
.lua:
local cjson = require "cjson
.safe"
local http = require "resty
.http"
-- 1
) 解析 Nginx 内置变量和 Headers
local method = ngx
.req
.get_method
()
local uri = ngx
.var
.request_uri
local headers = {
user_agent = ngx
.var
.http_user_agent or "",
cookie = ngx
.var
.http_cookie or "",
host = ngx
.var
.http_host or "",
content_type = ngx
.var
.http_content_type or ""
}
-- 2
) 解析
GET 参数
ngx
.req
.read_body
() -- 必须先读取 body，否则取不到 POST
local args = ngx
.req
.get_uri_args
()
local query_params = {}
for k, v in pairs
(args
) do
query_params[k] = v
end
-- 3
) 解析 POST 数据: 根据 content_type 判断JSON或表单
local post_data = {}
if headers
.content_type and string
.find
(headers
.content_type, "application/json"
) then
local body_data = ngx
.req
.get_body_data
()
if body_data then
local json_data = cjson
.decode
(body_data
)
if json_data then
post_data = json_data
else
ngx
.log
(ngx
.ERR, "JSON 解析失败"
)
end
end
else
local post_args = ngx
.req
.get_post_args
()
for k, v in pairs
(post_args
) do
post_data[k] = v
end
end
-- 4
) 整合请求数据并日志输出
local request_data = {
method = method,
uri = uri,
headers = headers,
query_params = query_params,
post_data = post_data,
client_ip = ngx
.var
.remote_addr
}
ngx
.log
(ngx
.ERR, "OpenResty 解析的数据: "
.. cjson
.encode
(request_data
))
-- 5
) 调用 Flask WAF 后端
local httpc = http
.new
()
local res, err = httpc:request_uri
("http://127
.0
.0
.1:5000/detect", {
method = "POST",
body = cjson
.encode
(request_data
),
headers = {
["Content-Type"] = "application/json"
}
}
)
if
not res then
ngx
.log
(ngx
.ERR, "Flask WAF 请求失败: ", err
)
ngx
.status = 500
ngx
.header["Content-Type"] = "text/html; charset=utf-8"
ngx
.say
("WAF 检测异常"
)
return ngx
.exit
(500
)
end
-- 6
) 复用连接
local ok, err_keep = httpc:set_keepalive
(60000, 100
)
if
not ok then
ngx
.log
(ngx
.ERR, "设置 keepalive 失败: ", err_keep
)
end
ngx
.log
(ngx
.ERR, "Flask 返回: ", res
.body
)
-- 7
) 解析Flask响应并处理（修正pcall返回值）
if res
.status ~= 200 then
ngx
.log
(ngx
.ERR, "Flask 返回非200状态码: ", res
.status
)
ngx
.status = 500
ngx
.header["Content-Type"] = "text/html; charset=utf-8"
ngx
.say
("Flask 服务异常"
)
return ngx
.exit
(500
)
end
local success, decoded_data = pcall
(cjson
.decode, res
.body
)
if
not success then
ngx
.log
(ngx
.ERR, "Flask 响应JSON解析失败: ", decoded_data
)
ngx
.status = 500
ngx
.header["Content-Type"] = "text/html; charset=utf-8"
ngx
.say
("WAF 响应格式错误"
)
return ngx
.exit
(500
)
end
local waf_result = decoded_data
-- 8
) 判断是否存在SQL注入（根据app
.py的响应结构）
local is_sqli = false
local detections = waf_result
.detections or {}
for i = 1, #detections do
local detection = detections[i]
-- 检查检测结果是否为表类型且包含检测结果字段
if type
(detection
) == "table" and detection["检测结果"] then
if detection["检测结果"] == "存在SQL注入" then
is_sqli = true
break
end
end
end
-- for _, detection in ipairs
(waf_result
.detections or {}
) do
-- if detection["检测结果"] == "存在SQL注入" then
-- is_sqli = true
-- break
-- end
-- end
-- 9
) 根据检测结果决定是否拦截
if is_sqli then
ngx
.log
(ngx
.ERR, "WAF阻断 SQL注入"
)
ngx
.status = ngx
.HTTP_FORBIDDEN
ngx
.header["Content-Type"] = "text/html; charset=utf-8"
ngx
.say
([[
<!DOCTYPE html>
<html lang="zh">
<head>
<meta charset="utf-8"/>
<title>访问受限</title>
<style>
/* 全局样式重置 */
* {
margin: 0;
padding: 0;
box-sizing: border-box;
}
body {
display: flex;
justify-content: center;
align-items: center;
min-height: 100vh;
background-color: #000;
color: #fff;
font-family: "Microsoft YaHei", Arial, sans-serif;
}
.container {
width: 90%;
max-width: 600px;
padding: 40px;
text-align: center;
border: 1px solid rgba
(255, 255, 255, 0
.1
);
border-radius: 8px;
background: rgba
(10, 10, 10, 0
.8
);
backdrop-filter: blur
(5px
);
box-shadow: 0 0 15px rgba
(255, 255, 255, 0
.05
);
}
h1 {
margin-bottom: 20px;
font-size: 2
.5rem;
letter-spacing: 2px;
color: #fff;
text-shadow: 0 0 10px rgba
(0, 255, 255, 0
.5
);
}
p {
margin-bottom: 30px;
font-size: 1
.1rem;
line-height: 1
.8;
color: rgba
(255, 255, 255, 0
.9
);
}
.btn-back {
display: inline-block;
padding: 12px 30px;
background: transparent;
color: #00ffcc;
border: 1px solid #00ffcc;
border-radius: 4px;
font-size: 1rem;
font-weight: bold;
text-decoration: none;
transition: all 0
.3s ease;
cursor: pointer;
}
.btn-back:hover {
background: rgba
(0, 255, 204, 0
.1
);
box-shadow: 0 0 15px rgba
(0, 255, 204, 0
.3
);
transform: translateY
(-2px
);
}
</style>
</head>
<body>
<div class="container">
<h1>访问受限</h1>
<p>
检测到疑似SQL注入/跨站脚本攻击
(XXS
)的恶意行为特征，<br/>
为保障系统安全，本次请求未被授权执行<br/>
</p>
<a href="javascript:void
(0
)" class="btn-back" id="backBtn">返回上一页</a>
</div>
<script>
// 点击按钮返回前一个页面状态
document
.getElementById
('backBtn'
).addEventListener
('click', function
() {
history
.back
();
}
);
</script>
</body>
]]
)
else
ngx
.log
(ngx
.ERR, "WAF 判断正常，放行请求"
)
return -- 关键：放行请求，继续执行proxy_pass
end
本文介绍了解决IIS服务器上woff字体文件出现404错误的方法，包括在Web.config文件中配置woff字体的MIME类型以及直接在IIS中添加woff字体的MIME类型。
扫一扫
1374
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
