Expose: an IDS for PHP

Expose is an Intrusion Detection System for PHP loosely based on the PHPIDS project (and using its ruleset for detecting potential threats).

ALL CREDIT for the rule set for Expose goes to the PHPIDS project. Expose literally uses the same JSON configuration for its execution. I am not claiming any kind of ownership or authorship of these rules. Please see the PHPIDS github README for names of those who have contributed.

NOTE: An IDS system should not be relied upon for sole protection in your environment! It should only be used in the first level of threat identification. Please read up on "Defense in Depth" for more information on a layered security approach.

Quick Install

1. Install Composer:

   curl -s https://getcomposer.org/installer | php
   

2. Require Expose as a dependency using Composer:

   php composer.phar require barracudanetworks/expose
   

3. Install Expose:

   php composer.phar install
   

Example Usage

<?php
require 'vendor/autoload.php';

$data = array(
    'POST' => array(
        'test' => 'foo',
        'bar' => array(
            'baz' => 'quux',
            'testing' => '<script>test</script>'
        )
    )
);

$filters = new \Expose\FilterCollection();
$filters->load();

//instantiate a PSR-3 compatible logger
$logger = new Logger();

$manager = new \Expose\Manager($filters, $logger);
$manager->run($data);

echo 'impact: '.$manager->getImpact()."\n"; // should return 8

// get all matching filter reports
$reports = $manager->getReports();
print_r($reports);

// export out the report in the given format ("text" is default)
echo $manager->export();
echo "\n\n";

Parent Project Documentation

Parent GitHub [https://github.com/enygma/expose]

Full (current) documentation for Expose can be found here: ReadTheDocs for Expose

If you're curious as to the importance of application-level intrusion detection, check out this article on the OWASP site.

Feel free to contact me with questions or how you can help the project!

@author Chris Cornutt [email protected]

Reason For Fork

The above project has not been maintained and is no longer compatible with current versions of PHP.

Currently supported versions:

• PHP 7.4
• PHP 8.0
• PHP 8.1
• PHP 8.2

Latest Changes

In an effort to simplify the library, we limited dependencies to the following:

• psr/log
  • Allows the use of any logger library for PHP such as monolog
  • Libraries supporting the standard.
• psr/simple-cache
  • Allows for PHP cache providers that support PSR-16 and can use tools such as redis.
  • Libraries supporting the standard.
• psr/event-dispatcher
  • Supporting an event-dispatcher standard allows applications that use this library to maintain how they want to use alerts and removed the requirement it supports MongoDB and Email.
  • Libraries supporting the standard.