wafaHell 0.2.0__py3-none-any.whl → 1.0.0__py3-none-any.whl

wafaHell/app.py

@@ -0,0 +1,31 @@
+from middleware import WafaHell
+from flask import Flask, render_template, request
+from werkzeug.middleware.proxy_fix import ProxyFix
+
+app = Flask(__name__)
+
+
+app.wsgi_app = ProxyFix(
+    app.wsgi_app,
+    x_for=1,
+    x_proto=1,
+    x_host=1,
+    x_port=1
+)
+
+@app.route('/', methods=['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'])
+def home():
+    return "<h1>Bem-vindo à minha aplicação Flask!</h1><p>Acesse /hello?nome=test</p>"
+
+@app.route('/hello', methods=['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'])
+def hello():
+    nome = request.args.get('nome', 'Visitante')
+    return f"<h1>Olá, {nome}!</h1>"
+
+@app.route('/admin/dashboard')
+def dashboard():
+    return "<h1>Dashboard Personalizado</h1><p>Este é o painel de controle personalizado.</p>"
+
+if __name__ == '__main__':
+    WafaHell(app, dashboard_path='/hell/dashboard', block_durantion=1, rate_limit=True, block_ip=True)
+    app.run(debug=True, host='0.0.0.0', port=5000)

wafaHell/globals.py

@@ -0,0 +1,5 @@
+import os
+from diskcache import Cache
+
+cache_path = '/dev/shm/waf_cache' if os.path.exists('/dev/shm') else './waf_cache_temp'
+waf_cache = Cache(cache_path)

wafaHell/logger.py

@@ -1,34 +1,121 @@
+from datetime import datetime
 import logging
+from model import WafLog, get_session
+import re 
+# Handler customizado para salvar no SQLite via SQLAlchemy
+class SQLAlchemyHandler(logging.Handler):
+    def __init__(self):
+            super().__init__()
+            self.session = get_session()
+            # Regex para extrair dados da string formatada pelo parse_req
+            self.attr_pattern = re.compile(
+                r"Attack_type: (?P<type>.*?), IP: (?P<ip>.*?), .*?Path: (?P<path>.*?), Method: (?P<method>.*?), Payload: (?P<payload>.*?), attack_local: (?P<local>.*)"
+            )
+
+    def emit(self, record):
+            session = self.session # Certifique-se de instanciar a sessão
+            try:
+                msg = record.getMessage()
+                
+                # Valores padrão
+                ip, path, method, payload, local, attack_type = (None, None, None, msg, None, "Info")
+
+                # Expandimos a condição para incluir [BLOCKED]
+                if any(tag in msg for tag in ["[ATTACK]", "[RATE LIMIT]", "[BLOCKED]"]):
+                    
+                    def extract(key, text):
+                        # Regex ajustada para capturar até a vírgula ou fim da tag, permitindo espaços internos
+                        match = re.search(rf"{key}:?\s*([^,\]]+)", text)
+                        return match.group(1).strip() if match else None
+
+                    ip = extract("IP", msg)
+                    
+                    if "[BLOCKED]" in msg:
+                        attack_type = "IP BLOCK"
+                        ua = extract("UA", msg)
+                        payload = f"IP Bloqueado. User-Agent: {ua}" if ua else "IP Bloqueado"
+                        path = "---"
+                        method = "---"
+                    elif "[RATE LIMIT]" in msg:
+                        attack_type = "RATE LIMIT"
+                        payload = "Exceeded request limit"
+                        path = extract("Path", msg)
+                        method = extract("Method", msg)
+
+                        bucket = datetime.utcnow().strftime('%Y-%m-%d %H:%M')
+                        log_entry = WafLog(
+                            level=record.levelname,
+                            attack_type=attack_type,
+                            ip=ip,
+                            path=path,
+                            method=method,
+                            payload=payload,
+                            attack_local=local,
+                            time_bucket=bucket
+                        )
+                        
+                        session.add(log_entry)
+                        session.commit()
+                    else:
+                        # Lógica para [ATTACK]
+                        attack_type = extract("Attack_type", msg) or "Unknown"
+                        path = extract("Path", msg)
+                        method = extract("Method", msg)
+                        
+                        # Captura o local completo (ex: HEADER 'User-Agent')
+                        local_match = re.search(r"attack_local:\s*(.+)$", msg)
+                        local = local_match.group(1).strip() if local_match else extract("attack_local", msg)
+                        
+                        # Regex específica para payloads que podem conter vírgulas
+                        payload_match = re.search(r"Payload: (.*?), attack_local:", msg)
+                        payload = payload_match.group(1) if payload_match else extract("Payload", msg)
+                    
+                if not "[RATE LIMIT]" in msg:   
+                    log_entry = WafLog(
+                        level=record.levelname,
+                        attack_type=attack_type,
+                        ip=ip,
+                        path=path,
+                        method=method,
+                        payload=payload,
+                        attack_local=local,
+                        # time_bucket fica None aqui para não filtrar ataques normais no banco
+                    )
+
+                    session.add(log_entry)
+                    session.commit()
+                    
+            except Exception as e:
+                session.rollback()
+            finally:
+                session.close()
 
 class Logger:
     def __init__(self, name="WAF", log_file="waf.log", level=logging.INFO):
-        # Cria logger com nome
         self.logger = logging.getLogger(name)
         self.logger.setLevel(level)
 
-        # Evita handlers duplicados ao reinicializar
         if not self.logger.handlers:
-            # Handler para console
-            console_handler = logging.StreamHandler()
-            console_handler.setLevel(level)
-
-            # Handler para arquivo
-            file_handler = logging.FileHandler(log_file)
-            file_handler.setLevel(level)
-
-            # Formato
             formatter = logging.Formatter(
                 "[%(asctime)s] [%(name)s] [%(levelname)s] %(message)s",
                 datefmt="%H:%M:%S - %d/%m/%Y"
             )
 
+            # Handler 1: Console
+            console_handler = logging.StreamHandler()
             console_handler.setFormatter(formatter)
-            file_handler.setFormatter(formatter)
-
-            # Adiciona handlers
             self.logger.addHandler(console_handler)
+
+            # Handler 2: Arquivo
+            file_handler = logging.FileHandler(log_file)
+            file_handler.setFormatter(formatter)
             self.logger.addHandler(file_handler)
 
+            # Handler 3: Banco de Dados (A Mágica acontece aqui)
+            db_handler = SQLAlchemyHandler()
+            db_handler.setLevel(logging.INFO) # Salva INFO, WARNING e acima no DB
+            self.logger.addHandler(db_handler)
+
     def info(self, msg):
         self.logger.info(msg)
 

wafaHell/middleware.py

@@ -1,151 +1,351 @@
+from datetime import datetime, timedelta, timezone 
+import os
 import re
-from flask import request as req, abort
+import subprocess
+import time
+from flask import request as req, abort, g
 from urllib.parse import unquote
-from model import Blocked, get_session
+from model import Base, Blocked, WafLog, get_session, engine
 from logger import Logger
-from utils import is_block_expired
 from rateLimiter import RateLimiter
 from sqlalchemy.exc import OperationalError
+from panel import setup_dashboard
+from utils import Admin
+from sqlalchemy import text
+from globals import waf_cache
 
 # Inicializa o RateLimiter
 limiter = RateLimiter(limit=100, window=60)
 
 class WafaHell:
-    def __init__(self, app=None, block_code=403, log_func=None, monitor_mode=False, block_ip=False, rate_limit=False):
+    def __init__(self, app=None, block_code=403, block_durantion=5, block_ip=False, log_func=None, monitor_mode=False,  rate_limit=False, dashboard_path=None):
         self.app = app
         self.block_code = block_code
         self.log = log_func or Logger()
         self.monitor_mode = monitor_mode
         self.block_ip = block_ip
         self.rate_limit = rate_limit
+        self.dashboard_path = dashboard_path
+        self.block_durantion = block_durantion
+        self.recent_blocks_cache = {}
 
-        self.rules = [
+        self.rules_sqli = [
             r"(\bUNION\b|\bSELECT\b|\bINSERT\b|\bDROP\b)",  
-            r"' OR '1'='1",                                
+            r"' OR '1'='1"                                                                                                                                                                                                                                
+        ]
+        self.rules_xss = [
             r"<script.*?>.*?</script>",                    
-            r"javascript:",                                
+            r"javascript:"
         ]
 
         if app is not None:
             self.init_app(app)
 
     def init_app(self, app):
-        # Configura a sessão para cada requisição
+        Base.metadata.create_all(engine)
+        setup_dashboard(app, self.dashboard_path)
+        Admin.create_admin_user(get_session())
+
+        if not app.secret_key:
+            app.secret_key = os.urandom(24)
+
         @app.before_request
         def create_session():
             try:
-                req.session = get_session()  # Cria uma nova sessão usando get_session
+                req.session = get_session()
             except Exception as e:
                 self.log.error(f"Erro ao criar sessão para requisição: {e}")
-                abort(self.block_code)  # Retorna erro 500 se não conseguir criar a sessão
+                abort(self.block_code)
 
-        # Fecha a sessão após cada requisição
         @app.teardown_request
         def close_session(exc=None):
             if hasattr(req, 'session'):
                 try:
-                    req.session.close()  # Fecha a sessão para liberar a conexão
+                    req.session.close()
                 except Exception as e:
                     self.log.error(f"Erro ao fechar sessão: {e}")
+        
 
         @app.before_request
         def waf_check():
             self.verify_client_blocked(req)
             self.verify_rate_limit(req)
-            is_malicious, attack_local, payload = self.is_malicious(req)
+            is_malicious, attack_local, payload, attack_type = self.is_malicious(req)
             
             if not is_malicious:
                 return
             
             if not self.monitor_mode:
-                self.log.warning(self.parse_req(req, payload,attack_local))
+                self.log.warning(self.parse_req(req, payload, attack_local, attack_type))
                 self.block_ip_address(req.remote_addr, req.headers.get("User-Agent", "unknown"))
+                abort(self.block_code)
             else:
-                self.log.info(self.parse_req(req, payload, attack_local))
+                self.log.info(self.parse_req(req, payload, attack_local, attack_type))
+
+        @app.before_request
+        def start_timer():
+            g.waf_start_time = time.time()
+
+        @app.after_request
+        def stop_timer(response):
+            ignored_paths = [self.dashboard_path, f'{self.dashboard_path}/stats', '/static']
+
+            # 1. Ignora rotas do próprio painel para não sujar os logs e métricas
+            if any(req.path.startswith(path) for path in ignored_paths):
+                return response
+            
+            # 2. LOG DE TRÁFEGO LEGÍTIMO
+            # Se o status_code for menor que 400, significa que o WAF não deu abort()
+            # e a requisição seguiu o fluxo normal.
+            if response.status_code != self.block_code:
+                self.log_legit_access(req)
+
+            # 3. RPS Logic (Bucketing by second)
+            current_timestamp = int(time.time())
+            rps_key = f"rps_{current_timestamp}"
+            waf_cache.incr(rps_key, default=0)
+            waf_cache.expire(rps_key, 10)
+
+            # 4. Latency Logic
+            if hasattr(g, 'waf_start_time'):
+                latency = (time.time() - g.waf_start_time) * 1000
+                
+                # Exponential Moving Average
+                old_avg = waf_cache.get('latency_avg', default=0.0)
+                new_avg = (old_avg * 0.95) + (latency * 0.05) if old_avg > 0 else latency
+                
+                waf_cache.set('latency_avg', new_avg, expire=3600)
+                
+            return response
+        
+    def log_legit_access(self, req):
+        session = get_session()
+        try:
+            new_log = WafLog(
+                timestamp=datetime.now(timezone.utc),
+                attack_type='INFO', # Identificador de tráfego limpo
+                ip=req.remote_addr,
+                path=req.path,
+                method=req.method,
+                level='INFO'
+            )
+            session.add(new_log)
+            session.commit()
+        except Exception as e:
+            session.rollback()
+            self.log.error(f"Error logging legit access: {e}")
+        finally:
+            session.close()
 
     def detect_attack(self, data: str) -> bool:
-        for pattern in self.rules:
+        for pattern in self.rules_xss:
             if re.search(pattern, data, re.IGNORECASE):
-                return True
-        return False
+                return "XSS"
+        for pattern in self.rules_sqli:
+            if re.search(pattern, data, re.IGNORECASE):
+                return "SQLI"
+        return None
 
-    def is_malicious(self, req) -> tuple[bool, str | None, str | None]:
+    def is_malicious(self, req) -> tuple:
+        attack = self.detect_attack(req.base_url)
+        if attack:
+            print(f"[DEBUG] Attack detected in URL: {attack}")
+            return True, "URL", req.base_url, attack
+        
+        for key, value in req.form.items():
+            attack = self.detect_attack(value)
+            if attack:
+                print(f"[DEBUG] Attack detected in FORM '{key}': {attack}")
+                return True, f"FORM '{key}'", value, attack
         
-        if self.detect_attack(req.base_url):
-            return True, "URL", req.base_url
-
         for key, value in req.args.items():
-            if self.detect_attack(value):
-                return True, f"QUERY '{key}'", value
+            attack = self.detect_attack(value)
+            if attack:
+                print(f"[DEBUG] Attack detected in QUERY '{key}': {attack}")
+                return True, f"QUERY '{key}'", value, attack
 
         for key, value in req.headers.items():
-            if self.detect_attack(value):
-                return True, f"HEADER '{key}'", value
+            attack = self.detect_attack(value)
+            if attack:
+                print(f"[DEBUG] Attack detected in HEADER '{key}': {attack}")
+                return True, f"HEADER '{key}'", value, attack
 
         if req.data:
             body_content = req.data.decode(errors="ignore")
-            if self.detect_attack(body_content):
-                return True, "BODY", body_content
+            attack = self.detect_attack(body_content)
+            if attack:
+                print(f"[DEBUG] Attack detected in BODY: {attack}")
+                return True, "BODY", body_content, attack
             
         if req.is_json:
             json_data = req.get_json(silent=True)
             if json_data:
                 import json
                 json_str = json.dumps(json_data)
-                if self.detect_attack(json_str):
-                    return True, "JSON BODY", json_str
+                attack = self.detect_attack(json_str)
+                if attack:
+                    print(f"[DEBUG] Attack detected in JSON BODY: {attack}")
+                    return True, "JSON BODY", json_str, attack
 
-        return False, None, None
+        return False, None, None, None
 
     def verify_client_blocked(self, req) -> None:
         session = req.session
         try:
             client_blocked = session.query(Blocked).filter_by(
-                ip=req.remote_addr, user_agent=req.headers.get("User-Agent")
+                ip=req.remote_addr,
             ).first()
+
             if client_blocked:
-                if is_block_expired(client_blocked.blocked_at):
+
+                now = datetime.now(timezone.utc) if client_blocked.blocked_until.tzinfo else datetime.utcnow()
+                
+                if client_blocked.blocked_until <= now:
+                    # --- TRAVA DE DESBLOQUEIO (Anti-Race Condition) ---
+                    # Usamos um marcador no cache para saber se alguém já está desbloqueando este IP
+                    cache_key = f"unblocking_{req.remote_addr}"
+                    if cache_key in self.recent_blocks_cache:
+                        return # Outra thread já está limpando este IP, apenas saia
+                    
+                    self.recent_blocks_cache[cache_key] = True
+                    # --------------------------------------------------
+
+                    try:
+                        session.delete(client_blocked)
+                        session.commit()
+                        
+                        # Limpa os caches de controle deste IP
+                        self.recent_blocks_cache.pop(req.remote_addr, None)
+                        self.recent_blocks_cache.pop(cache_key, None)
+                        
+                        self.log.info(f"[UNBLOCKED] IP {req.remote_addr} bloqueio expirou.")
+                    except Exception as e:
+                        session.rollback()
+                        self.recent_blocks_cache.pop(cache_key, None)
+                        raise e
+                    return
+
+                # Se chegou aqui, ainda está bloqueado
+                abort(self.block_code)
+
+        except OperationalError:
+            session.rollback()
+            abort(self.block_code)
+
+        try:
+                        
+            client_blocked = session.query(Blocked).filter_by(
+                ip=req.remote_addr,
+                user_agent=req.headers.get("User-Agent")
+            ).first()
+
+            if not client_blocked:
+                return
+
+            # Normaliza o tempo para comparação
+            now = datetime.now(timezone.utc) if client_blocked.blocked_until.tzinfo else datetime.utcnow()
+            
+            if client_blocked.blocked_until <= now:
+                # --- TRAVA DE DESBLOQUEIO (Anti-Race Condition) ---
+                # Usamos um marcador no cache para saber se alguém já está desbloqueando este IP
+                cache_key = f"unblocking_{req.remote_addr}"
+                if cache_key in self.recent_blocks_cache:
+                    return # Outra thread já está limpando este IP, apenas saia
+                
+                self.recent_blocks_cache[cache_key] = True
+                # --------------------------------------------------
+
+                try:
                     session.delete(client_blocked)
                     session.commit()
-                    self.log.info(f"[UNBLOCKED] IP {req.remote_addr} desbloqueado apos expiracao do bloqueio.")
-                else:
-                    abort(self.block_code)
-        except OperationalError as e:
+                    
+                    # Limpa os caches de controle deste IP
+                    self.recent_blocks_cache.pop(req.remote_addr, None)
+                    self.recent_blocks_cache.pop(cache_key, None)
+                    
+                    self.log.info(f"[UNBLOCKED] IP {req.remote_addr} bloqueio expirou.")
+                except Exception as e:
+                    session.rollback()
+                    self.recent_blocks_cache.pop(cache_key, None)
+                    raise e
+                return
+                
+            abort(self.block_code)
+
+        except OperationalError:
             session.rollback()
             abort(self.block_code)
-            
 
     def block_ip_address(self, ip, user_agent=None):
-        if self.block_ip:
-            try:
-                session = req.session
-                blocked_client = Blocked(ip=ip, user_agent=user_agent)
-                session.add(blocked_client)
-                session.commit()
-                self.log.warning(f"[BLOCKED] IP: {ip}, User-Agent: {user_agent}")
-            except OperationalError as e:
-                self.log.error(f"Erro de banco de dados ao bloquear IP {ip}: {e}")
-                session.rollback()
-                abort(self.block_code)
-            except Exception as e:
-                self.log.error(f"Erro ao bloquear IP {ip}: {e}")
-                session.rollback()
+        if not self.block_ip:
+            return
+
+        # 1. Trava de Memória (ajuda, mas não resolve 100% em multi-processo)
+        now_ts = datetime.now().timestamp()
+        if ip in self.recent_blocks_cache:
+            if now_ts - self.recent_blocks_cache[ip] < 5:
+                return 
+        self.recent_blocks_cache[ip] = now_ts
+
+        session = get_session()
+        try:
+            # 2. TRAVA DE BANCO: Verifica se já houve um log desse IP nos últimos 2 segundos
+            # Isso evita que as 6 threads do ffuf que passaram pela trava de memória gravem no banco
+            
+            time_threshold = datetime.now(timezone.utc) - timedelta(seconds=2)
+            
+            # Buscamos na tabela de LOGS (WafLog) se já existe um registro recente
+           
+            exists_recent_log = session.query(WafLog).filter(
+                WafLog.ip == ip,
+                WafLog.attack_type.in_(['RATE LIMIT', 'IP BLOCK']),
+                WafLog.timestamp >= time_threshold
+            ).first()
+
+            if not exists_recent_log:
+                # Só prossegue se não houver log recente
+                exists_block = session.query(Blocked).filter_by(ip=ip).first()
+                if not exists_block:
+                    now = datetime.now(timezone.utc)
+                    until = now + timedelta(minutes=self.block_durantion)
+                    
+                    new_block = Blocked(
+                        ip=ip, user_agent=user_agent,
+                        blocked_at=now, blocked_until=until
+                    )
+                    session.add(new_block)
+                    session.commit()
+                    
+                    
+                    
+        except Exception as e:
+            session.rollback()
+            self.log.error(f"Erro ao persistir bloqueio: {e}")
+        finally:
+            session.close()
 
     def verify_rate_limit(self, req) -> None:
         if self.rate_limit:
-            ip = req.remote_addr
-            ua = req.headers.get("User-Agent", "unknown")
-            if limiter.is_rate_limited(ip, ua):
-                self.log.warning(f"[RATE LIMIT] IP: {ip}, User-Agent: {ua} excedeu o limite de requisições.")
-                if self.block_ip:
-                    self.block_ip_address(ip, ua)
-                abort(self.block_code)
+                ip = req.remote_addr
+                ua = req.headers.get("User-Agent", "unknown")
+                
+                if limiter.is_rate_limited(ip, ua):
+                    if self.monitor_mode:
+                        return
+                    
+                    
+                    if self.block_ip:
+                        self.block_ip_address(ip, ua)
+                        self.log.warning(f"[RATE LIMIT] IP: {ip} exceeded limit.")
+                        self.log.warning(f"[BLOCKED] IP: {ip}, UA: {ua}")
+                        abort(self.block_code)
+
+                    self.log.warning(f"[RATE LIMIT] IP: {ip} exceeded limit.")
 
-    def parse_req(self, req, payload, attack_local=None) -> str:
+    def parse_req(self, req, payload, attack_local=None, attack_type=None) -> str:
         ip = req.remote_addr
         user_agent = req.headers.get("User-Agent", "unknown")
         path = req.path
         method = req.method
         attack_local = attack_local or "unknown"
-        msg = f"""[ATTACK] IP: {ip}, User-Agent: {user_agent}, Path: {path}, Method: {method}, Payload: {unquote(payload)}, attack_local: {attack_local}"""
-        return msg
+        return f"[ATTACK] Attack_type: {attack_type}, IP: {ip}, User-Agent: {user_agent}, Path: {path}, Method: {method}, Payload: {unquote(payload)}, attack_local: {attack_local}"

wafaHell/mock.py

@@ -0,0 +1,53 @@
+import requests
+
+# Configuração do alvo
+BASE_URL = "http://127.0.0.1:5000/hello"
+
+# Definição dos payloads de teste (SQLi e XSS clássicos)
+payloads = {
+    "URL Query": {"url": f"{BASE_URL}?id=1' OR '1'='1"},
+    "Form Data": {"method": "POST", "data": {"user": "<script>alert(1)</script>"}},
+    "JSON Body": {"method": "POST", "json": {"search": "SELECT * FROM users"}},
+    "Cookies": {"method": "POST", "cookies": {"session": "UNION SELECT NULL,NULL--"}},
+    "Custom Header": {"method": "POST", "headers": {"User-Agent": "'; DROP TABLE logs;--"}},
+    "Multipart File": {"method": "POST", "files": {"file": ("README.md", "payload: <script>alert('XSS')</script>")}},
+}
+
+def run_mock():
+    print(f"🚀 Iniciando Mock de Testes WafaHell no alvo: {BASE_URL}\n")
+    print(f"{'VETOR DE TESTE':<20} | {'STATUS':<10} | {'RESULTADO'}")
+    print("-" * 55)
+
+    for test_name, config in payloads.items():
+        try:
+            # Prepara a requisição
+            url = config.get("url", BASE_URL)
+            method = config.get("method", "GET")
+            
+            # Executa a requisição com os parâmetros dinâmicos
+            response = requests.request(
+                method=method,
+                url=url,
+                data=config.get("data"),
+                json=config.get("json"),
+                cookies=config.get("cookies"),
+                headers=config.get("headers"),
+                files=config.get("files"),
+                timeout=5
+            )
+
+            # Validação: 403 significa que o WAF bloqueou (Sucesso no teste)
+            if response.status_code == 403:
+                status_txt = "✅ BLOQUEADO"
+                result_txt = "Sucesso (WAF Ativo)"
+            else:
+                status_txt = f"❌ {response.status_code}"
+                result_txt = "Falha (Vulnerável!)"
+
+            print(f"{test_name:<20} | {status_txt:<10} | {result_txt}")
+
+        except Exception as e:
+            print(f"{test_name:<20} | ⚠️ ERRO      | {str(e)}")
+
+if __name__ == "__main__":
+    run_mock()