public function testAddingAnotherEventAfterCalculation() { $this->testImpactSum(); $this->testGetTags(); $this->report->addEvent(new Event('key_c', 'val_c', array(new Filter(1, 'test_c1', 'desc_c1', array('tag_c1'), 10)))); $this->assertEquals(20, $this->report->getImpact()); $this->assertEquals(array('tag_a1', 'tag_a2', 'tag_a3', 'tag_b1', 'tag_b2', 'tag_b3', 'tag_c1'), $this->report->getTags()); }
/** * Process results from IDS scan. * * @param \IDS\Init $init PHPIDS init object reference. * @param \IDS\Report $result The result object from PHPIDS. * * @return void */ private function _processIdsResult(\IDS\Init $init, \IDS\Report $result) { // $result contains any suspicious fields enriched with additional info // Note: it is moreover possible to dump this information by simply doing //"echo $result", calling the \IDS\Report::$this->__toString() method implicitely. $requestImpact = $result->getImpact(); if ($requestImpact < 1) { // nothing to do return; } // update total session impact to track an attackers activity for some time $sessionImpact = SessionUtil::getVar('idsImpact', 0) + $requestImpact; SessionUtil::setVar('idsImpact', $sessionImpact); // let's see which impact mode we are using $idsImpactMode = System::getVar('idsimpactmode', 1); $idsImpactFactor = 1; if ($idsImpactMode == 1) { $idsImpactFactor = 1; } elseif ($idsImpactMode == 2) { $idsImpactFactor = 10; } elseif ($idsImpactMode == 3) { $idsImpactFactor = 5; } // determine our impact threshold values $impactThresholdOne = System::getVar('idsimpactthresholdone', 1) * $idsImpactFactor; $impactThresholdTwo = System::getVar('idsimpactthresholdtwo', 10) * $idsImpactFactor; $impactThresholdThree = System::getVar('idsimpactthresholdthree', 25) * $idsImpactFactor; $impactThresholdFour = System::getVar('idsimpactthresholdfour', 75) * $idsImpactFactor; $usedImpact = $idsImpactMode == 1 ? $requestImpact : $sessionImpact; // react according to given impact if ($usedImpact > $impactThresholdOne) { // db logging // determine IP address of current user $_REMOTE_ADDR = System::serverGetVar('REMOTE_ADDR'); $_HTTP_X_FORWARDED_FOR = System::serverGetVar('HTTP_X_FORWARDED_FOR'); $ipAddress = $_HTTP_X_FORWARDED_FOR ? $_HTTP_X_FORWARDED_FOR : $_REMOTE_ADDR; $currentPage = System::getCurrentUri(); $currentUid = UserUtil::getVar('uid'); if (!$currentUid) { $currentUid = 1; } // get entity manager $em = ServiceUtil::get('doctrine.entitymanager'); $intrusionItems = array(); foreach ($result as $event) { $eventName = $event->getName(); $malVar = explode(".", $eventName, 2); $filters = array(); foreach ($event as $filter) { array_push($filters, array('id' => $filter->getId(), 'description' => $filter->getDescription(), 'impact' => $filter->getImpact(), 'tags' => $filter->getTags(), 'rule' => $filter->getRule())); } $tagVal = $malVar[1]; $newIntrusionItem = array('name' => array($eventName), 'tag' => $tagVal, 'value' => $event->getValue(), 'page' => $currentPage, 'user' => $em->getReference('ZikulaUsersModule:UserEntity', $currentUid), 'ip' => $ipAddress, 'impact' => $result->getImpact(), 'filters' => serialize($filters), 'date' => new \DateTime("now")); if (array_key_exists($tagVal, $intrusionItems)) { $intrusionItems[$tagVal]['name'][] = $newIntrusionItem['name'][0]; } else { $intrusionItems[$tagVal] = $newIntrusionItem; } } // log details to database foreach ($intrusionItems as $tag => $intrusionItem) { $intrusionItem['name'] = implode(", ", $intrusionItem['name']); $obj = new IntrusionEntity(); $obj->merge($intrusionItem); $em->persist($obj); } $em->flush(); } if (System::getVar('idsmail') && $usedImpact > $impactThresholdTwo) { // mail admin // prepare mail text $mailBody = __('The following attack has been detected by PHPIDS') . "\n\n"; $mailBody .= __f('IP: %s', $ipAddress) . "\n"; $mailBody .= __f('UserID: %s', $currentUid) . "\n"; $mailBody .= __f('Date: %s', DateUtil::strftime(__('%b %d, %Y'), time())) . "\n"; if ($idsImpactMode == 1) { $mailBody .= __f('Request Impact: %d', $requestImpact) . "\n"; } else { $mailBody .= __f('Session Impact: %d', $sessionImpact) . "\n"; } $mailBody .= __f('Affected tags: %s', join(' ', $result->getTags())) . "\n"; $attackedParameters = ''; foreach ($result as $event) { $attackedParameters .= $event->getName() . '=' . urlencode($event->getValue()) . ", "; } $mailBody .= __f('Affected parameters: %s', trim($attackedParameters)) . "\n"; $mailBody .= __f('Request URI: %s', urlencode($currentPage)); // prepare other mail arguments $siteName = System::getVar('sitename'); $adminmail = System::getVar('adminmail'); $mailTitle = __('Intrusion attempt detected by PHPIDS'); if (ModUtil::available('ZikulaMailerModule')) { $args = array(); $args['fromname'] = $siteName; $args['fromaddress'] = $adminmail; $args['toname'] = 'Site Administrator'; $args['toaddress'] = $adminmail; $args['subject'] = $mailTitle; $args['body'] = $mailBody; $rc = ModUtil::apiFunc('ZikulaMailerModule', 'user', 'sendmessage', $args); } else { $headers = "From: {$siteName} <{$adminmail}>\n" . "X-Priority: 1 (Highest)"; System::mail($adminmail, $mailTitle, $mailBody, $headers); } } if ($usedImpact > $impactThresholdThree) { // block request if (System::getVar('idssoftblock')) { // warn only for debugging the ruleset throw new \RuntimeException(__('Malicious request code / a hacking attempt was detected. This request has NOT been blocked!')); } else { throw new AccessDeniedException(__('Malicious request code / a hacking attempt was detected. Thus this request has been blocked.'), null, $result); } } return; }
/** * get Report String from Report Object * * @param \IDS\Report $oIdsReport * @access public * @static * @return string */ public static function getReport(\IDS\Report $oIdsReport) { $sReport = ''; $sReport .= 'Total impact: ' . $oIdsReport->getImpact() . "\n"; $sReport .= 'Affected tags: ' . implode(', ', $oIdsReport->getTags()) . "\n"; foreach ($oIdsReport->getIterator() as $oEvent) { $sReport .= 'Variable: ' . $oEvent->getName() . '|'; $sReport .= 'Value: ' . htmlentities($oEvent->getValue()) . "\n"; $sReport .= 'Impact: ' . $oEvent->getImpact() . ' | '; $sReport .= 'Tags: ' . implode(', ', $oEvent->getTags()) . "\n"; foreach ($oEvent as $oFilter) { $sReport .= 'Description: ' . $oFilter->getDescription() . ' | '; $sReport .= 'Tags: ' . implode(', ', $oFilter->getTags()) . "\n"; } } return $sReport; }