{"id":28570117,"url":"https://github.com/wallarm/libdetection","last_synced_at":"2025-06-10T17:40:14.181Z","repository":{"id":56144392,"uuid":"48718886","full_name":"wallarm/libdetection","owner":"wallarm","description":"Signature-free approach library to detect injection and commanding attacks","archived":false,"fork":false,"pushed_at":"2022-01-25T07:33:04.000Z","size":397,"stargazers_count":84,"open_issues_count":1,"forks_count":19,"subscribers_count":11,"default_branch":"master","last_synced_at":"2024-03-26T19:07:44.973Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-2-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/wallarm.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2015-12-29T00:29:30.000Z","updated_at":"2023-12-08T12:39:33.000Z","dependencies_parsed_at":"2022-08-15T13:31:12.528Z","dependency_job_id":null,"html_url":"https://github.com/wallarm/libdetection","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wallarm%2Flibdetection","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wallarm%2Flibdetection/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wallarm%2Flibdetection/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wallarm%2Flibdetection/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/wallarm","download_url":"https://codeload.github.com/wallarm/libdetection/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wallarm%2Flibdetection/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":259118864,"owners_count":22808071,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-06-10T17:40:07.201Z","updated_at":"2025-06-10T17:40:14.172Z","avatar_url":"https://github.com/wallarm.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# libdetection\n\nExtendable library for detection syntaxes by formal notations.\nCan be used to detect injections and commanding attacks such as SQLi and others.\nDoes not require attacks samples to learn.\n\n\n## Requirements\n\n- cmake\n- cunit\n- bison\n- re2c\n- [libwallarmmisc](https://github.com/wallarm/libwallarmmisc)\n\n## Installation\n\nTo build, run\n\n```sh\n$ ./config\n```\nor, to build with optimizations\n\n```sh\n$ CFLAGS=\"-Ofast -mtune=native -march=native\" ./configure\n```\n\nthen run make\n\n```sh\n$ make -C build\n```\n\nAfter that, you will get\n\n1. The library `build/lib/libdetection.so`\n2. Example executable: `build/perf/libdetection_perf`\n\n\n## Extend syntaxes\n\nTo add your own module to the library, you have to\n\n1. Add the module code into a new directory under `lib/`. See\n   `lib/sqli/sqli.c` code which implements libdetection interface\n   for sqli module (look at `detect_parser_sqli` global variable).\n2. Make libdetection to load the module statically, see\n   `TRYLOAD` in `detect_parser_init()`. Dynamic loading is not\n   implemented yet.\n3. Include your module name in `lib/CMakeLists.txt` for automatic building.\n\n\n## Formal model\n\nFor attacks detection, a formal model is used which allows to make a decision based on the type of attack. This approach allows us to implement the library without having to specify precedents of attacks (without a signature of each specific attack). Here you will not find the files with fingerprints or static rules with regular expressions.\n\nDetermination of the attack - the user input (string coming to the input of the library) can be processed as a sequence of data, among which there will be at least one syntax instruction.\n\nFor example, in the string `123 union select` there are one data token and two instructions (commands). And the string is considered to be an attack. But it’s not complete as there no names of column and table used.\n\nWithin the library, each parser state (where line processing begins) is called a context. Contexts are formulated in such a way to reduce the number of false positives of similar type.\n\n\n### Types of attacks in a single syntax\n\nThe library supports a variety of contexts (the parser states) with two main groups - injection attacks and commanding attacks. This approach allows us to share all the attacks on the two groups suitable for subsequent analysis and attribution to vulnerabilities in the code.\n\nFor example, for phpMyAdmin or similar tools, a set of parameters for query parameter will take attacks such commanding as legitimate. Such attacks will consist entirely of SQL syntax for initial parsing state: `? Query = SELECT id FROM users ...`. At the same time the defective syntax of SQL (injection attacks) in these parameters can be easily blocked, for example: `? Query = 123 UNION SELECT id FROM users - a-`.\n\nFor ease of understanding, you can distinguish injections and commanding attacks in the following way. In the case of injection attacks, there is, at least, one user input to be handled entirely as data. If the case of commanding attacks any user input will contain at least one instruction.\n\n\n### Syntax\n\nCurrently, we publish PoC for only SQL syntax. This allows you to test the idea against different SQL-injection attacks. To add new syntax (eg, path traversal, bash / sh, PHP, HTML5, JavaScript) you only need to describe the lexer and the BNF. So you can avoid programming in C. Just copy directory `./lib/sqli`, and then edit the files `sqli_lexer.re2c` (lexer description) and `sqli_parser.y` (syntax description in BNF). That's all you need to do. No need to write regular expressions or collecting attacks samples.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwallarm%2Flibdetection","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fwallarm%2Flibdetection","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwallarm%2Flibdetection/lists"}