wafaHell 0.1.1__py3-none-any.whl → 1.0.0__py3-none-any.whl

wafaHell/__init__.py

@@ -1,3 +1,3 @@
 from .middleware import WafaHell
 
-# agora a classe está disponível diretamente ao importar o pacote
+__all__ = ["WafaHell"]

wafaHell/app.py

@@ -0,0 +1,31 @@
+from middleware import WafaHell
+from flask import Flask, render_template, request
+from werkzeug.middleware.proxy_fix import ProxyFix
+
+app = Flask(__name__)
+
+
+app.wsgi_app = ProxyFix(
+    app.wsgi_app,
+    x_for=1,
+    x_proto=1,
+    x_host=1,
+    x_port=1
+)
+
+@app.route('/', methods=['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'])
+def home():
+    return "<h1>Bem-vindo à minha aplicação Flask!</h1><p>Acesse /hello?nome=test</p>"
+
+@app.route('/hello', methods=['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'])
+def hello():
+    nome = request.args.get('nome', 'Visitante')
+    return f"<h1>Olá, {nome}!</h1>"
+
+@app.route('/admin/dashboard')
+def dashboard():
+    return "<h1>Dashboard Personalizado</h1><p>Este é o painel de controle personalizado.</p>"
+
+if __name__ == '__main__':
+    WafaHell(app, dashboard_path='/hell/dashboard', block_durantion=1, rate_limit=True, block_ip=True)
+    app.run(debug=True, host='0.0.0.0', port=5000)

wafaHell/globals.py

@@ -0,0 +1,5 @@
+import os
+from diskcache import Cache
+
+cache_path = '/dev/shm/waf_cache' if os.path.exists('/dev/shm') else './waf_cache_temp'
+waf_cache = Cache(cache_path)

wafaHell/logger.py

@@ -0,0 +1,132 @@
+from datetime import datetime
+import logging
+from model import WafLog, get_session
+import re 
+# Handler customizado para salvar no SQLite via SQLAlchemy
+class SQLAlchemyHandler(logging.Handler):
+    def __init__(self):
+            super().__init__()
+            self.session = get_session()
+            # Regex para extrair dados da string formatada pelo parse_req
+            self.attr_pattern = re.compile(
+                r"Attack_type: (?P<type>.*?), IP: (?P<ip>.*?), .*?Path: (?P<path>.*?), Method: (?P<method>.*?), Payload: (?P<payload>.*?), attack_local: (?P<local>.*)"
+            )
+
+    def emit(self, record):
+            session = self.session # Certifique-se de instanciar a sessão
+            try:
+                msg = record.getMessage()
+                
+                # Valores padrão
+                ip, path, method, payload, local, attack_type = (None, None, None, msg, None, "Info")
+
+                # Expandimos a condição para incluir [BLOCKED]
+                if any(tag in msg for tag in ["[ATTACK]", "[RATE LIMIT]", "[BLOCKED]"]):
+                    
+                    def extract(key, text):
+                        # Regex ajustada para capturar até a vírgula ou fim da tag, permitindo espaços internos
+                        match = re.search(rf"{key}:?\s*([^,\]]+)", text)
+                        return match.group(1).strip() if match else None
+
+                    ip = extract("IP", msg)
+                    
+                    if "[BLOCKED]" in msg:
+                        attack_type = "IP BLOCK"
+                        ua = extract("UA", msg)
+                        payload = f"IP Bloqueado. User-Agent: {ua}" if ua else "IP Bloqueado"
+                        path = "---"
+                        method = "---"
+                    elif "[RATE LIMIT]" in msg:
+                        attack_type = "RATE LIMIT"
+                        payload = "Exceeded request limit"
+                        path = extract("Path", msg)
+                        method = extract("Method", msg)
+
+                        bucket = datetime.utcnow().strftime('%Y-%m-%d %H:%M')
+                        log_entry = WafLog(
+                            level=record.levelname,
+                            attack_type=attack_type,
+                            ip=ip,
+                            path=path,
+                            method=method,
+                            payload=payload,
+                            attack_local=local,
+                            time_bucket=bucket
+                        )
+                        
+                        session.add(log_entry)
+                        session.commit()
+                    else:
+                        # Lógica para [ATTACK]
+                        attack_type = extract("Attack_type", msg) or "Unknown"
+                        path = extract("Path", msg)
+                        method = extract("Method", msg)
+                        
+                        # Captura o local completo (ex: HEADER 'User-Agent')
+                        local_match = re.search(r"attack_local:\s*(.+)$", msg)
+                        local = local_match.group(1).strip() if local_match else extract("attack_local", msg)
+                        
+                        # Regex específica para payloads que podem conter vírgulas
+                        payload_match = re.search(r"Payload: (.*?), attack_local:", msg)
+                        payload = payload_match.group(1) if payload_match else extract("Payload", msg)
+                    
+                if not "[RATE LIMIT]" in msg:   
+                    log_entry = WafLog(
+                        level=record.levelname,
+                        attack_type=attack_type,
+                        ip=ip,
+                        path=path,
+                        method=method,
+                        payload=payload,
+                        attack_local=local,
+                        # time_bucket fica None aqui para não filtrar ataques normais no banco
+                    )
+
+                    session.add(log_entry)
+                    session.commit()
+                    
+            except Exception as e:
+                session.rollback()
+            finally:
+                session.close()
+
+class Logger:
+    def __init__(self, name="WAF", log_file="waf.log", level=logging.INFO):
+        self.logger = logging.getLogger(name)
+        self.logger.setLevel(level)
+
+        if not self.logger.handlers:
+            formatter = logging.Formatter(
+                "[%(asctime)s] [%(name)s] [%(levelname)s] %(message)s",
+                datefmt="%H:%M:%S - %d/%m/%Y"
+            )
+
+            # Handler 1: Console
+            console_handler = logging.StreamHandler()
+            console_handler.setFormatter(formatter)
+            self.logger.addHandler(console_handler)
+
+            # Handler 2: Arquivo
+            file_handler = logging.FileHandler(log_file)
+            file_handler.setFormatter(formatter)
+            self.logger.addHandler(file_handler)
+
+            # Handler 3: Banco de Dados (A Mágica acontece aqui)
+            db_handler = SQLAlchemyHandler()
+            db_handler.setLevel(logging.INFO) # Salva INFO, WARNING e acima no DB
+            self.logger.addHandler(db_handler)
+
+    def info(self, msg):
+        self.logger.info(msg)
+
+    def warning(self, msg):
+        self.logger.warning(msg)
+
+    def error(self, msg):
+        self.logger.error(msg)
+
+    def critical(self, msg):
+        self.logger.critical(msg)
+
+    def debug(self, msg):
+        self.logger.debug(msg)

wafaHell/middleware.py

@@ -1,65 +1,351 @@
+from datetime import datetime, timedelta, timezone 
+import os
 import re
-from flask import request, abort
+import subprocess
+import time
+from flask import request as req, abort, g
 from urllib.parse import unquote
+from model import Base, Blocked, WafLog, get_session, engine
+from logger import Logger
+from rateLimiter import RateLimiter
+from sqlalchemy.exc import OperationalError
+from panel import setup_dashboard
+from utils import Admin
+from sqlalchemy import text
+from globals import waf_cache
+
+# Inicializa o RateLimiter
+limiter = RateLimiter(limit=100, window=60)
 
 class WafaHell:
-    def __init__(self, app=None, block_code=403, log_func=None, monitor_mode=False):
+    def __init__(self, app=None, block_code=403, block_durantion=5, block_ip=False, log_func=None, monitor_mode=False,  rate_limit=False, dashboard_path=None):
         self.app = app
         self.block_code = block_code
-        self.log_func = log_func or (lambda msg: print(f"[WAF] {msg}"))
+        self.log = log_func or Logger()
         self.monitor_mode = monitor_mode
-        # Regras básicas
-        self.rules = [
+        self.block_ip = block_ip
+        self.rate_limit = rate_limit
+        self.dashboard_path = dashboard_path
+        self.block_durantion = block_durantion
+        self.recent_blocks_cache = {}
+
+        self.rules_sqli = [
             r"(\bUNION\b|\bSELECT\b|\bINSERT\b|\bDROP\b)",  
-            r"' OR '1'='1",                                
+            r"' OR '1'='1"                                                                                                                                                                                                                                
+        ]
+        self.rules_xss = [
             r"<script.*?>.*?</script>",                    
-            r"javascript:",                                
+            r"javascript:"
         ]
 
         if app is not None:
             self.init_app(app)
 
     def init_app(self, app):
+        Base.metadata.create_all(engine)
+        setup_dashboard(app, self.dashboard_path)
+        Admin.create_admin_user(get_session())
+
+        if not app.secret_key:
+            app.secret_key = os.urandom(24)
+
+        @app.before_request
+        def create_session():
+            try:
+                req.session = get_session()
+            except Exception as e:
+                self.log.error(f"Erro ao criar sessão para requisição: {e}")
+                abort(self.block_code)
+
+        @app.teardown_request
+        def close_session(exc=None):
+            if hasattr(req, 'session'):
+                try:
+                    req.session.close()
+                except Exception as e:
+                    self.log.error(f"Erro ao fechar sessão: {e}")
+        
+
         @app.before_request
         def waf_check():
-            if self.is_malicious(request):
-                self.log_attack(request)
-                if not self.monitor_mode:
-                    abort(self.block_code)
+            self.verify_client_blocked(req)
+            self.verify_rate_limit(req)
+            is_malicious, attack_local, payload, attack_type = self.is_malicious(req)
+            
+            if not is_malicious:
+                return
+            
+            if not self.monitor_mode:
+                self.log.warning(self.parse_req(req, payload, attack_local, attack_type))
+                self.block_ip_address(req.remote_addr, req.headers.get("User-Agent", "unknown"))
+                abort(self.block_code)
+            else:
+                self.log.info(self.parse_req(req, payload, attack_local, attack_type))
+
+        @app.before_request
+        def start_timer():
+            g.waf_start_time = time.time()
+
+        @app.after_request
+        def stop_timer(response):
+            ignored_paths = [self.dashboard_path, f'{self.dashboard_path}/stats', '/static']
+
+            # 1. Ignora rotas do próprio painel para não sujar os logs e métricas
+            if any(req.path.startswith(path) for path in ignored_paths):
+                return response
+            
+            # 2. LOG DE TRÁFEGO LEGÍTIMO
+            # Se o status_code for menor que 400, significa que o WAF não deu abort()
+            # e a requisição seguiu o fluxo normal.
+            if response.status_code != self.block_code:
+                self.log_legit_access(req)
+
+            # 3. RPS Logic (Bucketing by second)
+            current_timestamp = int(time.time())
+            rps_key = f"rps_{current_timestamp}"
+            waf_cache.incr(rps_key, default=0)
+            waf_cache.expire(rps_key, 10)
+
+            # 4. Latency Logic
+            if hasattr(g, 'waf_start_time'):
+                latency = (time.time() - g.waf_start_time) * 1000
+                
+                # Exponential Moving Average
+                old_avg = waf_cache.get('latency_avg', default=0.0)
+                new_avg = (old_avg * 0.95) + (latency * 0.05) if old_avg > 0 else latency
+                
+                waf_cache.set('latency_avg', new_avg, expire=3600)
+                
+            return response
+        
+    def log_legit_access(self, req):
+        session = get_session()
+        try:
+            new_log = WafLog(
+                timestamp=datetime.now(timezone.utc),
+                attack_type='INFO', # Identificador de tráfego limpo
+                ip=req.remote_addr,
+                path=req.path,
+                method=req.method,
+                level='INFO'
+            )
+            session.add(new_log)
+            session.commit()
+        except Exception as e:
+            session.rollback()
+            self.log.error(f"Error logging legit access: {e}")
+        finally:
+            session.close()
 
     def detect_attack(self, data: str) -> bool:
-        for pattern in self.rules:
+        for pattern in self.rules_xss:
+            if re.search(pattern, data, re.IGNORECASE):
+                return "XSS"
+        for pattern in self.rules_sqli:
             if re.search(pattern, data, re.IGNORECASE):
-                return True
-        return False
+                return "SQLI"
+        return None
 
-    def is_malicious(self, req) -> bool:
-        # URL + Query Params
-        if self.detect_attack(req.url) or any(self.detect_attack(v) for v in req.args.values()):
-            return True
+    def is_malicious(self, req) -> tuple:
+        attack = self.detect_attack(req.base_url)
+        if attack:
+            print(f"[DEBUG] Attack detected in URL: {attack}")
+            return True, "URL", req.base_url, attack
+        
+        for key, value in req.form.items():
+            attack = self.detect_attack(value)
+            if attack:
+                print(f"[DEBUG] Attack detected in FORM '{key}': {attack}")
+                return True, f"FORM '{key}'", value, attack
+        
+        for key, value in req.args.items():
+            attack = self.detect_attack(value)
+            if attack:
+                print(f"[DEBUG] Attack detected in QUERY '{key}': {attack}")
+                return True, f"QUERY '{key}'", value, attack
 
-        # Headers
-        for _, value in req.headers.items():
-            if self.detect_attack(value):
-                return True
+        for key, value in req.headers.items():
+            attack = self.detect_attack(value)
+            if attack:
+                print(f"[DEBUG] Attack detected in HEADER '{key}': {attack}")
+                return True, f"HEADER '{key}'", value, attack
 
-        # Body
-        if req.data and self.detect_attack(req.data.decode(errors="ignore")):
-            return True
+        if req.data:
+            body_content = req.data.decode(errors="ignore")
+            attack = self.detect_attack(body_content)
+            if attack:
+                print(f"[DEBUG] Attack detected in BODY: {attack}")
+                return True, "BODY", body_content, attack
+            
+        if req.is_json:
+            json_data = req.get_json(silent=True)
+            if json_data:
+                import json
+                json_str = json.dumps(json_data)
+                attack = self.detect_attack(json_str)
+                if attack:
+                    print(f"[DEBUG] Attack detected in JSON BODY: {attack}")
+                    return True, "JSON BODY", json_str, attack
 
-        return False
+        return False, None, None, None
 
-    def log_attack(self, req):
+    def verify_client_blocked(self, req) -> None:
+        session = req.session
+        try:
+            client_blocked = session.query(Blocked).filter_by(
+                ip=req.remote_addr,
+            ).first()
+
+            if client_blocked:
+
+                now = datetime.now(timezone.utc) if client_blocked.blocked_until.tzinfo else datetime.utcnow()
+                
+                if client_blocked.blocked_until <= now:
+                    # --- TRAVA DE DESBLOQUEIO (Anti-Race Condition) ---
+                    # Usamos um marcador no cache para saber se alguém já está desbloqueando este IP
+                    cache_key = f"unblocking_{req.remote_addr}"
+                    if cache_key in self.recent_blocks_cache:
+                        return # Outra thread já está limpando este IP, apenas saia
+                    
+                    self.recent_blocks_cache[cache_key] = True
+                    # --------------------------------------------------
+
+                    try:
+                        session.delete(client_blocked)
+                        session.commit()
+                        
+                        # Limpa os caches de controle deste IP
+                        self.recent_blocks_cache.pop(req.remote_addr, None)
+                        self.recent_blocks_cache.pop(cache_key, None)
+                        
+                        self.log.info(f"[UNBLOCKED] IP {req.remote_addr} bloqueio expirou.")
+                    except Exception as e:
+                        session.rollback()
+                        self.recent_blocks_cache.pop(cache_key, None)
+                        raise e
+                    return
+
+                # Se chegou aqui, ainda está bloqueado
+                abort(self.block_code)
+
+        except OperationalError:
+            session.rollback()
+            abort(self.block_code)
+
+        try:
+                        
+            client_blocked = session.query(Blocked).filter_by(
+                ip=req.remote_addr,
+                user_agent=req.headers.get("User-Agent")
+            ).first()
+
+            if not client_blocked:
+                return
+
+            # Normaliza o tempo para comparação
+            now = datetime.now(timezone.utc) if client_blocked.blocked_until.tzinfo else datetime.utcnow()
+            
+            if client_blocked.blocked_until <= now:
+                # --- TRAVA DE DESBLOQUEIO (Anti-Race Condition) ---
+                # Usamos um marcador no cache para saber se alguém já está desbloqueando este IP
+                cache_key = f"unblocking_{req.remote_addr}"
+                if cache_key in self.recent_blocks_cache:
+                    return # Outra thread já está limpando este IP, apenas saia
+                
+                self.recent_blocks_cache[cache_key] = True
+                # --------------------------------------------------
+
+                try:
+                    session.delete(client_blocked)
+                    session.commit()
+                    
+                    # Limpa os caches de controle deste IP
+                    self.recent_blocks_cache.pop(req.remote_addr, None)
+                    self.recent_blocks_cache.pop(cache_key, None)
+                    
+                    self.log.info(f"[UNBLOCKED] IP {req.remote_addr} bloqueio expirou.")
+                except Exception as e:
+                    session.rollback()
+                    self.recent_blocks_cache.pop(cache_key, None)
+                    raise e
+                return
+                
+            abort(self.block_code)
+
+        except OperationalError:
+            session.rollback()
+            abort(self.block_code)
+
+    def block_ip_address(self, ip, user_agent=None):
+        if not self.block_ip:
+            return
+
+        # 1. Trava de Memória (ajuda, mas não resolve 100% em multi-processo)
+        now_ts = datetime.now().timestamp()
+        if ip in self.recent_blocks_cache:
+            if now_ts - self.recent_blocks_cache[ip] < 5:
+                return 
+        self.recent_blocks_cache[ip] = now_ts
+
+        session = get_session()
+        try:
+            # 2. TRAVA DE BANCO: Verifica se já houve um log desse IP nos últimos 2 segundos
+            # Isso evita que as 6 threads do ffuf que passaram pela trava de memória gravem no banco
+            
+            time_threshold = datetime.now(timezone.utc) - timedelta(seconds=2)
+            
+            # Buscamos na tabela de LOGS (WafLog) se já existe um registro recente
+           
+            exists_recent_log = session.query(WafLog).filter(
+                WafLog.ip == ip,
+                WafLog.attack_type.in_(['RATE LIMIT', 'IP BLOCK']),
+                WafLog.timestamp >= time_threshold
+            ).first()
+
+            if not exists_recent_log:
+                # Só prossegue se não houver log recente
+                exists_block = session.query(Blocked).filter_by(ip=ip).first()
+                if not exists_block:
+                    now = datetime.now(timezone.utc)
+                    until = now + timedelta(minutes=self.block_durantion)
+                    
+                    new_block = Blocked(
+                        ip=ip, user_agent=user_agent,
+                        blocked_at=now, blocked_until=until
+                    )
+                    session.add(new_block)
+                    session.commit()
+                    
+                    
+                    
+        except Exception as e:
+            session.rollback()
+            self.log.error(f"Erro ao persistir bloqueio: {e}")
+        finally:
+            session.close()
+
+    def verify_rate_limit(self, req) -> None:
+        if self.rate_limit:
+                ip = req.remote_addr
+                ua = req.headers.get("User-Agent", "unknown")
+                
+                if limiter.is_rate_limited(ip, ua):
+                    if self.monitor_mode:
+                        return
+                    
+                    
+                    if self.block_ip:
+                        self.block_ip_address(ip, ua)
+                        self.log.warning(f"[RATE LIMIT] IP: {ip} exceeded limit.")
+                        self.log.warning(f"[BLOCKED] IP: {ip}, UA: {ua}")
+                        abort(self.block_code)
+
+                    self.log.warning(f"[RATE LIMIT] IP: {ip} exceeded limit.")
+
+    def parse_req(self, req, payload, attack_local=None, attack_type=None) -> str:
         ip = req.remote_addr
         user_agent = req.headers.get("User-Agent", "unknown")
         path = req.path
-        query = req.query_string.decode(errors="ignore") if req.query_string else ""
-        
-        msg = (
-            f"Ataque detectado\n",
-            f"IP: {ip}\n"
-            f"User-Agent: {user_agent}\n"
-            f"Rota: {path}\n"
-            f"Query: {unquote(query)}\n"
-        )
-        self.log_func(msg)
+        method = req.method
+        attack_local = attack_local or "unknown"
+        return f"[ATTACK] Attack_type: {attack_type}, IP: {ip}, User-Agent: {user_agent}, Path: {path}, Method: {method}, Payload: {unquote(payload)}, attack_local: {attack_local}"

wafaHell/mock.py

@@ -0,0 +1,53 @@
+import requests
+
+# Configuração do alvo
+BASE_URL = "http://127.0.0.1:5000/hello"
+
+# Definição dos payloads de teste (SQLi e XSS clássicos)
+payloads = {
+    "URL Query": {"url": f"{BASE_URL}?id=1' OR '1'='1"},
+    "Form Data": {"method": "POST", "data": {"user": "<script>alert(1)</script>"}},
+    "JSON Body": {"method": "POST", "json": {"search": "SELECT * FROM users"}},
+    "Cookies": {"method": "POST", "cookies": {"session": "UNION SELECT NULL,NULL--"}},
+    "Custom Header": {"method": "POST", "headers": {"User-Agent": "'; DROP TABLE logs;--"}},
+    "Multipart File": {"method": "POST", "files": {"file": ("README.md", "payload: <script>alert('XSS')</script>")}},
+}
+
+def run_mock():
+    print(f"🚀 Iniciando Mock de Testes WafaHell no alvo: {BASE_URL}\n")
+    print(f"{'VETOR DE TESTE':<20} | {'STATUS':<10} | {'RESULTADO'}")
+    print("-" * 55)
+
+    for test_name, config in payloads.items():
+        try:
+            # Prepara a requisição
+            url = config.get("url", BASE_URL)
+            method = config.get("method", "GET")
+            
+            # Executa a requisição com os parâmetros dinâmicos
+            response = requests.request(
+                method=method,
+                url=url,
+                data=config.get("data"),
+                json=config.get("json"),
+                cookies=config.get("cookies"),
+                headers=config.get("headers"),
+                files=config.get("files"),
+                timeout=5
+            )
+
+            # Validação: 403 significa que o WAF bloqueou (Sucesso no teste)
+            if response.status_code == 403:
+                status_txt = "✅ BLOQUEADO"
+                result_txt = "Sucesso (WAF Ativo)"
+            else:
+                status_txt = f"❌ {response.status_code}"
+                result_txt = "Falha (Vulnerável!)"
+
+            print(f"{test_name:<20} | {status_txt:<10} | {result_txt}")
+
+        except Exception as e:
+            print(f"{test_name:<20} | ⚠️ ERRO      | {str(e)}")
+
+if __name__ == "__main__":
+    run_mock()

wafaHell/model.py

@@ -0,0 +1,100 @@
+from datetime import datetime
+from sqlalchemy import (
+    DateTime, Text, create_engine,
+    Column, Integer, String, UniqueConstraint
+)
+from sqlalchemy.orm import declarative_base, sessionmaker, scoped_session
+
+# =========================
+# CONFIGURAÇÃO GLOBAL
+# =========================
+
+DATABASE_URL = "sqlite:///wafaHell.db"
+
+engine = create_engine(
+    DATABASE_URL,
+    echo=False,
+    future=True
+)
+
+SessionLocal = scoped_session(
+    sessionmaker(
+        bind=engine,
+        autocommit=False,
+        autoflush=False
+    )
+)
+
+Base = declarative_base()
+
+# =========================
+# MODELS
+# =========================
+
+class Blocked(Base):
+    __tablename__ = "blocks"
+    
+    id = Column(Integer, primary_key=True, autoincrement=True)
+    ip = Column(String, nullable=True)
+    user_agent = Column(String, nullable=True)
+    blocked_at = Column(
+        String,
+        nullable=False,
+        default=lambda: datetime.now().strftime("%H:%M:%S")
+    )
+    blocked_until = Column(DateTime, nullable=False)
+
+    def __repr__(self):
+        return (
+            f"<Blocked(ip='{self.ip}', "
+            f"user_agent='{self.user_agent}', "
+            f"blocked_at='{self.blocked_at}', "
+            f"blocked_until='{self.blocked_until}')>"
+        )
+
+
+class WafLog(Base):
+    __tablename__ = "waf_logs"
+
+    id = Column(Integer, primary_key=True)
+    timestamp = Column(DateTime, default=datetime.utcnow)
+    
+    time_bucket = Column(String(20), index=True) 
+    
+    attack_type = Column(String(50))
+    ip = Column(String(50))
+    path = Column(String(200))
+    method = Column(String(10))
+    payload = Column(Text)
+    attack_local = Column(String(50))
+    level = Column(String(20))
+
+    __table_args__ = (
+        UniqueConstraint('ip', 'attack_type', 'time_bucket', name='uix_ip_attack_time'),
+    )
+
+
+class AdminUser(Base):
+    __tablename__ = "admin_user"
+
+    id = Column(Integer, primary_key=True, autoincrement=True)
+    login = Column(String(50), nullable=False, unique=True)
+    password = Column(String(255), nullable=False)
+
+    def __repr__(self):
+        return f"<AdminUser(login='{self.login}')>"
+
+
+# =========================
+# DB INIT / SESSION
+# =========================
+
+def init_db():
+    """Cria as tabelas uma única vez"""
+    Base.metadata.create_all(bind=engine)
+
+
+def get_session():
+    """Retorna uma sessão reutilizável"""
+    return SessionLocal()
+

wafaHell/panel.py

@@ -0,0 +1,192 @@
+from datetime import datetime, timedelta, timezone
+from flask import render_template_string, request, jsonify, make_response, flash, session, redirect, render_template
+from model import AdminUser, WafLog, get_session, Blocked
+from sqlalchemy import func
+import csv
+import io
+from utils import Admin, Dashboard, admin
+from werkzeug.security import check_password_hash
+dashboard = Dashboard()
+
+def get_logs_and_stats(ip_filter=None, type_filter=None, limit=100):
+    session = get_session()
+    try:
+        log_query = session.query(WafLog).order_by(WafLog.id.desc())
+        stat_query = session.query(func.count(WafLog.id))
+
+        if ip_filter:
+            log_query = log_query.filter(WafLog.ip == ip_filter)
+            stat_query = stat_query.filter(WafLog.ip == ip_filter)
+        if type_filter:
+            log_query = log_query.filter(WafLog.attack_type == type_filter)
+            stat_query = stat_query.filter(WafLog.attack_type == type_filter)
+
+        db_logs = log_query.limit(limit).all()
+        
+        # Estatísticas Dinâmicas
+        stats = {
+            "total": stat_query.scalar() or 0,
+            # Agora attacks conta tudo que não é 'Info' ou 'System'
+            "attacks": stat_query.filter(WafLog.attack_type.in_(['SQLI', 'XSS', 'RATE LIMIT'])).scalar() or 0,
+            "sqli": stat_query.filter(WafLog.attack_type == 'SQLI').scalar() or 0,
+            "xss": stat_query.filter(WafLog.attack_type == 'XSS').scalar() or 0,
+            "rate_limit": stat_query.filter(WafLog.attack_type == 'RATE LIMIT').scalar() or 0,
+            "blocks": stat_query.filter(WafLog.attack_type == 'IP BLOCK').scalar() or 0
+            }
+
+        formatted_logs = []
+        for log in db_logs:
+            # Determinamos o "Tipo" visual para o HTML
+            display_type = "INFO"
+            if log.attack_type in ['SQLI', 'XSS', 'RATE LIMIT']:
+                display_type = "ATTACK"
+            elif log.attack_type == 'IP BLOCK':
+                display_type = "BLOCKED" # Mudança aqui para o dashboard
+
+            formatted_logs.append({
+                "timestamp": log.timestamp.strftime("%H:%M:%S - %d/%m/%Y"),
+                "type": display_type,
+                "details": {
+                    "attack_type": log.attack_type,
+                    "ip": log.ip or "---",
+                    "path": log.path or "---",
+                    "method": log.method or "---",
+                    "payload": log.payload or "---",
+                    "attack_local": log.attack_local or "---"
+                }
+            })
+        return formatted_logs, stats
+    finally:
+        session.close()
+
+def setup_dashboard(app, custom_path=None):
+    target_path = custom_path or '/admin/dashboard'
+
+    @app.route(target_path + "/login", methods=["GET", "POST"])
+    def login():
+        if request.method == "POST":
+            username = request.form.get("user")
+            password = request.form.get("password")
+            db = get_session()
+            try:
+                admin = db.query(AdminUser).filter(AdminUser.login == username).first()
+
+                # 3. Valida (Aqui você deveria usar hash, mas vamos focar na lógica)
+                if admin and check_password_hash(admin.password, password):
+                    session["logged_in"] = True
+                    next_page = request.args.get("next", target_path)
+                    return redirect(next_page)
+                else:
+                    flash("Acesso Negado: Credenciais Inválidas", "error")
+                    return redirect(request.url)
+            finally:
+                db.close()
+
+        return render_template("login.html")
+    
+    @app.route(target_path + '/data')
+    @admin
+    def wafahell_data():
+        ip_f = request.args.get('ip')
+        type_f = request.args.get('type')
+        logs, stats = get_logs_and_stats(ip_filter=ip_f, type_filter=type_f)
+        return jsonify({"logs": logs, "stats": stats})
+
+    # Rota 2: Retorna o HTML inicial
+    @app.route(target_path)
+    @admin
+    def wafahell_dashboard():
+        ip_f = request.args.get('ip')
+        type_f = request.args.get('type')
+        logs, stats = get_logs_and_stats(ip_filter=ip_f, type_filter=type_f)
+        return render_template('dashboard.html', logs=logs, stats=stats, filters={'ip': ip_f, 'type': type_f})
+    
+    @app.route(target_path + '/export/csv')
+    @admin
+    def export_csv():
+
+        ip_filter = request.args.get('ip')
+        type_filter = request.args.get('type')
+        
+        session = get_session()
+        query = session.query(WafLog)
+        
+        if ip_filter:
+            query = query.filter(WafLog.ip == ip_filter)
+        if type_filter:
+            query = query.filter(WafLog.attack_type == type_filter)
+            
+        logs = query.order_by(WafLog.timestamp.desc()).all()
+        session.close()
+
+        # Criamos o CSV em memória
+        output = io.StringIO()
+        writer = csv.writer(output)
+        
+        # Cabeçalho
+        writer.writerow(['Data/Hora', 'Tipo', 'IP', 'Endpoint', 'Metodo', 'Payload'])
+        
+        for log in logs:
+            writer.writerow([
+                log.timestamp,
+                log.attack_type,
+                log.ip,
+                log.path,
+                log.method,
+                log.payload
+            ])
+
+        response = make_response(output.getvalue())
+        response.headers["Content-Disposition"] = f"attachment; filename=waf_logs_{datetime.now().strftime('%Y%m%d_%H%M')}.csv"
+        response.headers["Content-type"] = "text/csv"
+        return response
+
+    @app.route(target_path + '/block_ip', methods=['POST'])
+    @admin
+    def block_ip() -> bool:
+        data = request.get_json()
+        ip = data.get('ip')
+        block_time = data.get('block_time_minutes', 5) # Pega do JSON ou assume 5
+
+        if not ip:
+            return jsonify({"status": "error", "message": "IP ausente"}), 400
+
+        session = get_session()
+
+        try:
+            exists = session.query(Blocked).filter_by(ip=ip, user_agent="MANUAL_BLOCK").first()
+            if exists:
+                exists.blocked_until = datetime.now(timezone.utc) + timedelta(minutes=int(block_time))
+                session.commit()
+                return jsonify({"status": "success", "message": "Tempo de bloqueio atualizado"})
+
+            now = datetime.now(timezone.utc)
+            until = now + timedelta(minutes=int(block_time))
+
+            new_block = Blocked(
+                ip=ip,
+                user_agent="MANUAL_BLOCK",
+                blocked_until=until
+            )
+            
+            session.add(new_block)
+            session.commit()
+            return jsonify({"status": "success", "message": "IP bloqueado com sucesso"})
+        except Exception as e:
+            session.rollback()
+            return jsonify({"status": "error", "message": str(e)}), 500
+        finally:
+            session.close()
+
+    @app.route(target_path + '/graphs', methods=['GET'])
+    @admin
+    def graphs():
+        return render_template('graphs.html')
+    
+    @app.route(target_path + '/stats', methods=['GET'])
+    @admin
+    def api_stats():
+        return jsonify(dashboard.dashboard_setup())
+
+    print(f" * [WafaHell] Dashboard e API de dados prontos em: {target_path}")
+

wafaHell/rateLimiter.py

@@ -0,0 +1,20 @@
+
+from collections import defaultdict, deque
+from datetime import datetime, timedelta
+
+class RateLimiter:
+    def __init__(self, limit=100, window=60):
+        self.limit = limit
+        self.window = window
+        self.requests_log = defaultdict(lambda: deque())
+
+    def is_rate_limited(self, ip, ua):
+        key = (ip, ua)
+        now = datetime.now()
+        window_start = now - timedelta(seconds=self.window)
+
+        while self.requests_log[key] and self.requests_log[key][0] < window_start:
+            self.requests_log[key].popleft()
+
+        self.requests_log[key].append(now)
+        return len(self.requests_log[key]) >= self.limit

wafaHell/utils.py

@@ -0,0 +1,312 @@
+from datetime import datetime, timedelta, timezone
+import secrets
+import string
+import time
+from werkzeug.security import generate_password_hash
+from sqlalchemy.orm import Session
+from sqlalchemy import text, func, case
+from model import WafLog, Blocked
+from model import AdminUser
+from functools import wraps
+from flask import session, redirect, url_for, request
+from model import get_session
+from globals import waf_cache
+import geoip2.database
+import os
+
+class Admin:
+    @staticmethod
+    def generate_secure_password(length=64):
+        alphabet = string.ascii_letters + string.digits + string.punctuation
+        return ''.join(secrets.choice(alphabet) for _ in range(length))
+
+    @staticmethod
+    def create_admin_user(session: Session):
+        admin = session.query(AdminUser).filter_by(login="admin").first()
+        if admin:
+            return
+        raw_password = "admin" #Admin.generate_secure_password(64)
+        hashed_password = generate_password_hash(raw_password)
+
+        admin = AdminUser(
+            login="admin",
+            password=hashed_password
+        )
+
+        session.add(admin)
+        session.commit()
+
+        print("* [WafaHell] Usuario admin criado com sucesso.")
+        print("* [WafaHell] Salve essa senha em um lugar seguro, não será mostrada novamente")
+        print("Senha: ", raw_password)
+
+def admin(fn):
+    @wraps(fn)
+    def wrapper(*args, **kwargs):
+        print(f"DEBUG: Session logged_in status: {session.get('logged_in')}") # Adicione isso
+        if not session.get("logged_in"):
+            print("DEBUG: Redirecting to login...")
+            return redirect(url_for("login", next=request.path))
+        return fn(*args, **kwargs)
+    return wrapper
+
+class Dashboard:
+    def __init__(self):
+        self.db_session = get_session()
+        self.geo_db_path = os.path.join(os.path.dirname(__file__), 'GeoLite2-Country.mmdb')
+        
+    def dashboard_setup(self):
+        json = {}
+        def get_server_info():
+            server_time = datetime.now(timezone.utc).isoformat().replace('+00:00', 'Z')
+            node_id = "WAF-01"
+            avg_latency = waf_cache.get('latency_avg', default=0.0)
+            system_status = "critical" if avg_latency > 500 else "degraded" if avg_latency > 200 else "healthy"
+            return {
+                "server_time": server_time,
+                "node_id": node_id,
+                "average_latency_ms": round(float(avg_latency), 2),
+                "system_status": system_status
+            }
+        
+        def get_kpis():
+            now = datetime.now(timezone.utc)
+            last_24h = now - timedelta(hours=24)
+            prev_24h = now - timedelta(hours=48)
+
+            # --- TOTAIS DE HOJE ---
+            total_today = self.db_session.query(func.count(WafLog.id)).filter(WafLog.timestamp >= last_24h).scalar() or 0
+            blocked_today = self.db_session.query(func.count(WafLog.id)).filter(
+                WafLog.timestamp >= last_24h, 
+                WafLog.attack_type != 'INFO'
+            ).scalar() or 0
+
+            # --- TOTAIS DE ONTEM (Para Tendência) ---
+            total_yesterday = self.db_session.query(func.count(WafLog.id)).filter(
+                WafLog.timestamp >= prev_24h, 
+                WafLog.timestamp < last_24h
+            ).scalar() or 0
+            
+            blocked_yesterday = self.db_session.query(func.count(WafLog.id)).filter(
+                WafLog.timestamp >= prev_24h, 
+                WafLog.timestamp < last_24h,
+                WafLog.attack_type != 'INFO'
+            ).scalar() or 0
+
+            # --- CÁLCULO DE TENDÊNCIA (%) ---
+            def calc_trend(current, previous):
+                if previous == 0:
+                    return 100.0 if current > 0 else 0.0
+                return round(((current - previous) / previous * 100), 1)
+
+            trend_total = calc_trend(total_today, total_yesterday)
+            trend_attacks = calc_trend(blocked_today, blocked_yesterday)
+
+            # --- INFOS COMPLEMENTARES ---
+            from globals import waf_cache
+            # Latência e RPS vindos do Cache Global
+            last_second_timestamp = int(time.time()) - 1
+            rps_key = f"rps_{last_second_timestamp}"
+
+            # 2. Lê o valor real do cache para esse segundo específico
+            current_rps = waf_cache.get(rps_key, default=0)
+
+            # 3. Lógica do Pico (Peak)
+            # Aqui continuamos usando uma chave fixa 'rps_peak_hour' para guardar o recorde
+            peak_rps = waf_cache.get('rps_peak_hour', default=0)
+
+            if current_rps > peak_rps:
+                peak_rps = current_rps
+                # Atualiza o recorde no cache por 1 hora
+                waf_cache.set('rps_peak_hour', peak_rps, expire=3600)
+            
+            # Dados da Blacklist
+            total_blacklist = self.db_session.query(func.count(Blocked.id)).scalar() or 0
+            # Como blocked_at é String formatada no seu modelo, comparamos com o horário
+            added_today = self.db_session.query(func.count(Blocked.id)).filter(
+                Blocked.blocked_until >= now # Um IP "adicionado hoje" é tecnicamente um ainda bloqueado
+            ).scalar() or 0
+
+            return {
+                "total_requests_24h": {
+                    "value": total_today,
+                    "trend_percent": trend_total
+                },
+                "attacks_mitigated_24h": {
+                    "value": blocked_today,
+                    "trend_percent": trend_attacks # Adicionado aqui
+                },
+                "throughput": {
+                    "current_req_per_sec": current_rps,
+                    "peak_last_hour": peak_rps
+                },
+                "blacklist_count": {
+                    "total_ips": total_blacklist,
+                    "added_today": added_today
+                }
+            }
+        
+        def get_traffic_chart():
+            now = datetime.now(timezone.utc)
+            start_time = now - timedelta(minutes=40)
+
+            # Query para agrupar por minuto
+            # No SQLite usamos strftime, no Postgres/MySQL seria date_format ou similar
+            query = self.db_session.query(
+                func.strftime('%H:%M', WafLog.timestamp).label('minute'),
+                func.count(WafLog.id).label('total'),
+                func.sum(case({WafLog.attack_type == 'INFO': 1}, else_=0)).label('legit'),
+                func.sum(case({WafLog.attack_type != 'INFO': 1}, else_=0)).label('attacks')
+            ).filter(WafLog.timestamp >= start_time)\
+            .group_by('minute')\
+            .order_by('minute').all()
+
+            labels = []
+            series_legit = []
+            series_attacks = []
+
+            # Preenche os arrays para o gráfico
+            for row in query:
+                labels.append(row.minute)
+                series_legit.append(row.legit or 0)
+                series_attacks.append(row.attacks or 0)
+
+            # Caso não existam dados nos últimos 40 min, retorna arrays vazios para não quebrar o front
+            return {
+                "labels": labels,
+                "series_legit": series_legit,
+                "series_attacks": series_attacks
+            }
+
+        def get_distribution_vectors():
+            now = datetime.now(timezone.utc)
+            last_24h = now - timedelta(hours=24)
+
+            # 1. Buscamos a contagem agrupada por tipo de ataque
+            # Filtramos para não incluir tráfego legítimo (INFO)
+            query = self.db_session.query(
+                WafLog.attack_type,
+                func.count(WafLog.id).label('count')
+            ).filter(
+                WafLog.timestamp >= last_24h,
+                WafLog.attack_type != 'INFO'
+            ).group_by(WafLog.attack_type).all()
+
+            # 2. Calculamos o total de ataques para obter a porcentagem
+            total_attacks = sum(row.count for row in query)
+            
+            distribution = []
+            
+            for row in query:
+                percentage = round((row.count / total_attacks * 100), 1) if total_attacks > 0 else 0
+                distribution.append({
+                    "label": row.attack_type,
+                    "count": row.count,
+                    "percentage": percentage
+                })
+
+            # Caso não haja ataques, retornamos uma lista vazia ou um placeholder
+            return distribution
+
+        def get_top_geo():
+            def resolve_ip(ip):
+                try:         
+                    if not os.path.exists(self.geo_db_path):
+                        print("ERRO: Arquivo GeoLite2-Country.mmdb não encontrado!")
+                        return "XX", "Unknown"
+                        
+                    with geoip2.database.Reader(self.geo_db_path) as reader:
+                        response = reader.country(ip)
+                        return response.country.iso_code, response.country.name
+                except Exception as e:
+                    print(f"Erro na consulta GeoIP: {e}") # Isso vai te dizer se o banco está corrompido ou o IP é inválido
+                    return "XX", "Unknown"
+                
+            now = datetime.now(timezone.utc)
+            last_24h = now - timedelta(hours=24)
+
+            # 1. Busca todos os ataques agrupados por IP
+            query = self.db_session.query(
+                WafLog.ip,
+                func.count(WafLog.id).label('count')
+            ).filter(
+                WafLog.timestamp >= last_24h,
+                WafLog.attack_type != 'INFO'
+            ).group_by(WafLog.ip).all()
+
+            geo_stats = {}
+            total_attacks = 0
+
+            # 2. Processa cada IP real usando o GeoIP2
+            for row in query:
+                code, name = resolve_ip(row.ip)
+                
+                if code not in geo_stats:
+                    geo_stats[code] = {"name": name, "count": 0}
+                
+                geo_stats[code]["count"] += row.count
+                total_attacks += row.count
+
+            # 3. Formata o Top 5
+            top_geo = []
+            sorted_geo = sorted(geo_stats.items(), key=lambda x: x[1]['count'], reverse=True)[:5]
+
+            for code, data in sorted_geo:
+                percentage = round((data["count"] / total_attacks * 100), 1) if total_attacks > 0 else 0
+                top_geo.append({
+                    "country_code": code,
+                    "country_name": data["name"],
+                    "count": data["count"],
+                    "percentage": percentage
+                })
+
+            return top_geo
+        
+        def get_top_offenders():
+            now = datetime.now(timezone.utc)
+            last_24h = now - timedelta(hours=24)
+
+            # 1. Agrupamos por IP e contamos os hits e os tipos de ataques diferentes
+            # Ignoramos tráfego INFO
+            query = self.db_session.query(
+                WafLog.ip,
+                func.count(WafLog.id).label('hits_count'),
+                func.count(func.distinct(WafLog.attack_type)).label('unique_vectors')
+            ).filter(
+                WafLog.timestamp >= last_24h,
+                WafLog.attack_type != 'INFO'
+            ).group_by(WafLog.ip).order_by(text('hits_count DESC')).limit(5).all()
+
+            offenders = []
+            for row in query:
+                # 2. Lógica de Risk Score (0 a 100)
+                # Baseada em volume e diversidade de ataques
+                # Ex: Cada vetor único vale 20 pontos + 1 ponto para cada 50 hits (até o teto de 100)
+                vector_points = row.unique_vectors * 20
+                hit_points = row.hits_count // 50
+                risk_score = min(100, vector_points + hit_points)
+
+                offenders.append({
+                    "ip": row.ip,
+                    "risk_score": int(risk_score),
+                    "hits_count": row.hits_count
+                })
+
+            return offenders
+
+        try:
+            json['meta'] = get_server_info()
+            json['kpis'] = get_kpis()
+            json['traffic_chart'] = get_traffic_chart()
+            json['distribution_vectors'] = get_distribution_vectors()
+            json['top_geo'] = get_top_geo()
+            json['top_offenders'] = get_top_offenders()
+            
+            return json
+
+        except Exception as e:
+            print(f"Erro no Dashboard: {e}")
+            return {"error": str(e)}
+            
+        finally:
+            self.db_session.close()

{wafahell-0.1.1.dist-info → wafahell-1.0.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: wafaHell
-Version: 0.1.1
+Version: 1.0.0
 Summary: Middleware WAF to Flask
 Author-email: Yago Martins <yagomartins30@gmail.com>
 License: MIT License
@@ -33,6 +33,10 @@ Requires-Python: >=3.9
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: Flask>=2.0
+Requires-Dist: sqlalchemy>=2.0.0
+Requires-Dist: requests
+Requires-Dist: diskcache
+Requires-Dist: geoip2
 Dynamic: license-file
 
 # WafHell
@@ -42,14 +46,14 @@ Middleware WAF for Flask, to detect SQLi and XSS.
 ## Instalation
 
 ```bash
-pip install wafaHell
+pip install wafahell
 ```
 
 ## Usage
 ```python
 from flask import Flask
-from flask_waf import FlaskWAF
+from wafahell import WafaHell
 
 app = Flask(__name__)
-waf = FlaskWAF(app)
+waf = WafaHell(app)
 ```

wafahell-1.0.0.dist-info/RECORD

@@ -0,0 +1,15 @@
+wafaHell/__init__.py,sha256=bdafr3LRK7_frr-V6umEJZUqt8RMrOiLJy72DSQfs2o,60
+wafaHell/app.py,sha256=mXUCyOVrbU2Cdugh-UIDSQf-6zqvT2aazZtJQp_KKJI,980
+wafaHell/globals.py,sha256=keIe0YCNsb5si0yUhUjd6nlk1s0YgfH5G7lH5-05Zws,160
+wafaHell/logger.py,sha256=keT-Iw6g9w1dtrk0GhldxhgKtmNUVClgFGkSkAWXS5Y,5686
+wafaHell/middleware.py,sha256=cse81wj9ocUV11MPfrmvleD5nYq6asjDx6dqXToIcIs,14348
+wafaHell/mock.py,sha256=EgfSCKYV3rUTerKoEyFQPSf47wrOo-E0yqe7JpQUe3w,2105
+wafaHell/model.py,sha256=OB4sEucMSgO-DBLgLhqh0oBx5fZRug23MDnRc8vS5w4,2501
+wafaHell/panel.py,sha256=NpbvgXy5Regm4dQDoMapr-otW27TvC7Q-vdPrZDD-5k,7465
+wafaHell/rateLimiter.py,sha256=p4IDxha-ZrRPROFf8Fa1gRTbbUTQdbD9TgBTmyMR2hQ,664
+wafaHell/utils.py,sha256=v9NXo94AQiHjjCOgC38vwrlLoQOCZqp_qOjZVz00NEI,12750
+wafahell-1.0.0.dist-info/licenses/LICENSE,sha256=6bv9v4HamenV3rqm3mhaGOecwGFrgxtVTW7JPfFDmeY,1086
+wafahell-1.0.0.dist-info/METADATA,sha256=2EA_4vTwwoXimX_etFdZo_x_Z2_qijnbSjuIHfwE10Q,2087
+wafahell-1.0.0.dist-info/WHEEL,sha256=wUyA8OaulRlbfwMtmQsvNngGrxQHAvkKcvRmdizlJi0,92
+wafahell-1.0.0.dist-info/top_level.txt,sha256=VGBo2g3pOeTH2qIXfZDJCSblJgijemMHUHmI0bBgrls,9
+wafahell-1.0.0.dist-info/RECORD,,

{wafahell-0.1.1.dist-info → wafahell-1.0.0.dist-info}/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: setuptools (80.9.0)
+Generator: setuptools (80.10.2)
 Root-Is-Purelib: true
 Tag: py3-none-any
 

wafahell-0.1.1.dist-info/RECORD

@@ -1,7 +0,0 @@
-wafaHell/__init__.py,sha256=enTIAbStl7o_cDo93-s8nq86BsN3OEGYu9AbtESQVXQ,105
-wafaHell/middleware.py,sha256=UQ5TPcuz6UDyy5FjyUNXSAZqv2IjnOoc3ze2M8He7Tw,2151
-wafahell-0.1.1.dist-info/licenses/LICENSE,sha256=6bv9v4HamenV3rqm3mhaGOecwGFrgxtVTW7JPfFDmeY,1086
-wafahell-0.1.1.dist-info/METADATA,sha256=DKx0AS6ZJ82ATAkBJetN_AG8doVO00xxMI7PwBdcBzQ,1980
-wafahell-0.1.1.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
-wafahell-0.1.1.dist-info/top_level.txt,sha256=VGBo2g3pOeTH2qIXfZDJCSblJgijemMHUHmI0bBgrls,9
-wafahell-0.1.1.dist-info/RECORD,,