PHPIDS -- An Intrusion Detection System Ready To Use

Web applications are regularly threatened by attacks that try to exploit programming weaknesses . The PHP-based , open source PHPIDS solution detects attempted intrusions and raises the alarm when a threat is identified . PHPIDS neither strips , sanitizes nor filters any malicious input , it simply recognizes when an attacker tries to break your site and reacts in exactly the way you want it to . Based on a set of approved and heavily tested filter rules any attack is given a numerical impact rating  ( indicates the severity of the attack)  which makes it easy to decide what kind of action should follow the hacking attempt  . This could range from simple logging to sending out an emergency mail to the development team , logging into a Database-Table ( implements the singleton pattern and is based on PDO extension) , displaying a warning message for the attacker or even ending the user’s session .

Q: Will the PHPIDS protect my application by default?
Nope – the PHPIDS doesn’t touch any input variable by default – it just detects attack patterns and reports them. How your application reacts on those reports depends on your application. There are a lot of possible reactions so the PHPIDS doesn’t limit you in your creativity

The simplest scenario involves logging attacks to establish whether a site is being targeted and requires further protective measures . Furthermore modules  like the HTML parser htmlpurifier  are only included and used in case there is input coming in with a key matching the ones given in the Config.ini / via $monitor->setHtml() for content with HTML allowed. So the performance hungry components normally won’t be loaded during about 95% of all requests .

Let’s demonstrate a  basic example :

• First , download and unpack the phpids zip/tarbal archive , it will include a  licence-file  , a docs – tests  and – lib folder . Locate the IDS folder (into lib)  and move it into the directory that contains the web application . You can use the example.php file in the /docs/examples subdirectory for your first trials , as it is easily adapted . Simply remove any unnecessary items and change the paths in the file so that you’re only left with the following

  <?php
  
  //Define the path of PHPIDS lib
  set_include_path(
     get_include_path()
     . PATH_SEPARATOR
     . '.'
  );
  
  if (!session_id()) {
     session_start();
  }
  require_once 'IDS/Init.php';
  try {
  //Define what to scan
     $request = array(
         'REQUEST' => $_REQUEST,
         'GET' => $_GET,
         'POST' => $_POST,
         'COOKIE' => $_COOKIE
     );
  //Initiate the framework and define the path of it's central configuration file
     $init = IDS_Init::init(dirname(__FILE__) .
  'IDS/Config/Config.ini');
  /*
  The following three configurations are optional as they are defined into the centroal configuration file (see previous step) 
  */
     $init->config['General']['base_path'] = dirname(__FILE__) .
  'IDS/';
     $init->config['General']['use_base_path'] = true;
     $init->config['Caching']['caching'] = 'none';
  //Initiate "Monitor" , this is the actual work-horse 
     $ids = new IDS_Monitor($request, $init);
     $result = $ids->run();
  //If the returned object isn't empty (attack was detected) , act upon
     if (!$result->isEmpty()) {
  /*
  Initiate a Logging Class , alternatively , an Mail or DataBase Class could be initiated 
  */
         require_once 'IDS/Log/File.php';
         require_once 'IDS/Log/Composite.php';
         $compositeLog = new IDS_Log_Composite();
         $compositeLog->addLogger(IDS_Log_File::getInstance($init));
         $compositeLog->execute($result);
     } else {
   }
  } catch (Exception $e) {
     printf(
         'An error occured: %s',
         $e->getMessage()
     );
  }
  

  System admins tend to dislike having all lib- files accessible via the web server’s publicly accessible directories, as it potentially gives attackers room to play. PHPIDS can , therefore , also be installed and run outside of a publicly accessible web directory(in your lib-directory ) . For simplicity this article has uploaded PHPIDS’s folder into a publicly available  folder  which is protected by an “.htaccess” file with the following directive : deny from all

• IDS\Config\config.ini.php contains all the basic configurations separated into three sections (General , Logging and Caching ) . Each configuration is well commented to help us understand it’s functionality . Actually this is the place  where we shall configure PHPIDS behavior , though many of these configurations can be over-ridden  from your script  :
  //$init represents an initiated PHPID  object
  $init->config['General']['base_path'] = dirname(__FILE__) . ‘/../../lib/IDS/’ ;
  $init->config['General']['use_base_path'] = true;
  $init->config['Caching']['caching'] = ‘none’ ; 

A quick review of a script that implements the PHPIDS framework :

• Defining the include path and importing all Classes that are needed from the framework (require_once )
• Initiating the framework and passing the path of the central configuration file into it’s constructor function :
  $init = IDS_Init::init(dirname(__FILE__) . ‘/../../lib/IDS/Config/Config.ini.php’);
• Define new configuration values if we need to over-write configuration options that where defined in the central configuration file (IDS\Config\config.ini.php) .
• Initiating a PHPIDS object and fetching the results
   $ids = new IDS_Monitor($request, $init);
   $result = $ids->run();
• That’s it – In normal operation , the $result object will be empty . If an attack was detected , the $result object will embed all information which we can  analyze  and act upon (redirecting the user , logging to file / database or sending an email to the admin team ) .
• Logging the results into a file can be achieved by initiating a Composite() Class and passing the $result object into its constructor .
  $compositeLog = new IDS_Log_Composite();
  $compositeLog->execute($result);

Links :

• A list of XSS vectors to test PHPIDS 
• Get help/support from PHPID’s Forum .
• How to set-up PHPIDS on a Debian-based Linux distro .

About these ads