GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → leohearts → Awd Watchbird

leohearts / Awd Watchbird

Licence: agpl-3.0
A powerful PHP WAF for AWD

Labels

ctfwaf

Projects that are alternatives of or similar to Awd Watchbird

Pwn Sandbox
A sandbox to protect your pwn challenges being pwned in CTF AWD.
Stars: ✭ 81 (-54.49%)
Mutual labels:  ctf, waf
Code Audit Challenges
Code-Audit-Challenges
Stars: ✭ 779 (+337.64%)
Mutual labels:  ctf, waf
Print My Shell
Python script wrote to automate the process of generating various reverse shells.
Stars: ✭ 140 (-21.35%)
Mutual labels:  ctf
Pspy
Monitor linux processes without root permissions
Stars: ✭ 2,470 (+1287.64%)
Mutual labels:  ctf
Exploits
Exploits by 1N3 @CrowdShield @xer0dayz @XeroSecurity
Stars: ✭ 154 (-13.48%)
Mutual labels:  ctf
Glibc All In One
🎁A convenient glibc binary and debug file downloader and source code auto builder
Stars: ✭ 145 (-18.54%)
Mutual labels:  ctf
Ctf
CTF write-ups and some wargame sites write-ups.
Stars: ✭ 157 (-11.8%)
Mutual labels:  ctf
Curiefense
Curiefense is a unified, open source platform protecting cloud native applications.
Stars: ✭ 136 (-23.6%)
Mutual labels:  waf
Write Ups 2017
Wiki-like CTF write-ups repository, maintained by the community. 2017
Stars: ✭ 2,066 (+1060.67%)
Mutual labels:  ctf
Ctf.tf
A database of collected CTFs and their solutions.
Stars: ✭ 153 (-14.04%)
Mutual labels:  ctf
Ctf
some experience in CTFs
Stars: ✭ 165 (-7.3%)
Mutual labels:  ctf
Privilege Escalation
This cheasheet is aimed at the CTF Players and Beginners to help them understand the fundamentals of Privilege Escalation with examples.
Stars: ✭ 2,117 (+1089.33%)
Mutual labels:  ctf
Pwn Env Init
CTF PWN 做题环境一键搭建脚本
Stars: ✭ 147 (-17.42%)
Mutual labels:  ctf
Lctf2017
Source code, writeups and exps in LCTF2017.
Stars: ✭ 162 (-8.99%)
Mutual labels:  ctf
Openrasp
🔥Open source RASP solution
Stars: ✭ 2,036 (+1043.82%)
Mutual labels:  waf
Oscp Pentest Methodologies
备考 OSCP 的各种干货资料/渗透测试干货资料
Stars: ✭ 166 (-6.74%)
Mutual labels:  ctf
Whatwaf
Detect and bypass web application firewalls and protection systems
Stars: ✭ 1,881 (+956.74%)
Mutual labels:  waf
Attack Defense Challenges
Challenges of CTF Attack with Defense mode
Stars: ✭ 151 (-15.17%)
Mutual labels:  ctf
Ctf Writeups
Things we learned from Capture The Flag hacking competitions we participated in.
Stars: ✭ 155 (-12.92%)
Mutual labels:  ctf
Reverse Shell Manager
🔨 A multiple reverse shell session/client manager via terminal
Stars: ✭ 171 (-3.93%)
Mutual labels:  ctf
View All Similar Projects ➔

本项目禁止用于比赛. 如果您需要一个比赛场景下的WAF, 可以考虑DasSecurity-Labs/AoiAWD. (但请注意规则是否允许第三方通防)

Watchbird

Version 1.4

A powerful PHP WAF for AWD

功能:

  • 易于配置(单文件, 无需加载外部js/css)
  • 可以随时开启/关闭某项防御
  • 基本防御:
    • 数据库注入(sql injection)
    • 文件上传(upload)
    • 文件包含(lfi)
    • flag关键字
    • PHP反序列化(unserialize)
    • 命令执行(rce)
    • 分布式拒绝服务攻击(ddos)
    • 请求头,请求参数(GET/POST)关键字
    • 特殊字符
  • 深度防御:
    • 响应检测/反向代理(默认将流量发送至本地服务器自检,可配置代理服务器IP及端口实现反代功能)
    • 响应flag检测并返回虚假flag
    • 基于LD_PRELOAD的指令执行保护
    • 基于open_basedir的PHP文件操作保护
  • 网页控制台:
    • 功能开关及配置
    • 实时日志查看
    • 日志流量重放, 可广播流量至指定网段, 支持提取flag自动提交
    • RCE/文件上传/深度检测 防御通知(由于chrome无法允许不安全的网站(无SSL证书)显示通知,请使用Firefox并修改about:config中dom.webnotifications.allowinsecure为true)

使用

  1. git clone https://github.com/leohearts/awd-watchbird.git
  2. 编译waf.c生成.so文件,参考命令:gcc waf.c -shared -o waf.so
  3. 将waf.so,watchbird.php文件存放在/var/www/html或其他目录中
  4. 将watchbird.php放在www-data可读的目录, 确保当前用户对目标目录可写, 然后执行php watchbird.php --install [Web目录], 安装器将输出安装了watchbird的文件路径
  5. 访问任意启用了waf的文件, 参数?watchbird=ui打开watchbird控制台, 创建一个初始密码
  6. 如需卸载, 请在相同的位置输入php watchbird.php --uninstall [Web目录], 如果您多次运行了安装, 请多次运行卸载直到卸载器无输出

截图

Screenshot_2021-03-08 Watchbird控制台.png

Screenshot_2021-03-08 Watchbird控制台_1_.png

Screenshot_2021-03-08 Watchbird控制台_2_.png

贡献者

  • Leohearts
  • Longlone

本项目的开发仅出于研究目的, 请不要在比赛中使用.

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].