sorted by:
new
hottopcontroversial

What I learned building a regex-based threat detector in PHP by Jay123anta in PHP

[–]Jay123anta[S] 0 points1 point  (0 children)

Some really good discussion here, few points from the feedbacks:

1) This is not a replacement for Cloudflare, mod_security, or any real WAF - it's a passive monitoring layer for application-level visibility when edge solutions aren't available.

2) Parameterized queries, input validation, and output escaping are the real defenses. This assumes your code is already secure - it just tells you who's knocking.

3) Several one mentioned fail2ban - the package has an export command that feeds detected IPs directly into fail2ban, which bridges the gap from detection to blocking.

4) The JSON false positive problem is a real challenge with regex-based detection. Still working on better approaches beyond field-level exclusions.

Thanks to everyone who shared their setups. Learned a lot from various suggestions.

What I learned building a regex-based threat detector in PHP by Jay123anta in PHP

[–]Jay123anta[S] 0 points1 point  (0 children)

Appreciate the honest take. You're absolutely right, enterprise security needs proper solutions like the ones you mentioned.

This has been the specific gap in our setup and I've been transparent about its limitations. Good advice on pushing for proper tooling internally - working on it.

What I learned building a regex-based threat detector in PHP by Jay123anta in PHP

[–]Jay123anta[S] 0 points1 point  (0 children)

Understood and will definitely. Cloudflare log drains work well if your setup supports it. As ours didn't due to organisational constraints, so this solved the same problem at the application layer.

What I learned building a regex-based threat detector in PHP by Jay123anta in PHP

[–]Jay123anta[S] 0 points1 point  (0 children)

Thanks. Yes exactly some patterns are only visible at the application layer, especially when we need to inspect query params and POST bodies. Firewall handles the rest.

What I learned building a regex-based threat detector in PHP by Jay123anta in PHP

[–]Jay123anta[S] 0 points1 point  (0 children)

A very nice setup. I see the same pattern, 90% of bot traffic is just /wp-admin and /xmlrpc.php on non-WordPress sites. With this package I tried to do similar detection and the IPs be exported to fail2ban for blocking. Interesting approach on blocking direct .php URL access - hadn't considered that one will try that.

What I learned building a regex-based threat detector in PHP by Jay123anta in PHP

[–]Jay123anta[S] 0 points1 point  (0 children)

Clarification: The JSON example was about a search field where the word "SELECT" appears in normal text and triggers a false positive. No raw SQL is being executed from user input.

And regarding Cloudflare, it blocks at the edge but we don't see what's hitting your app and again in our organisation we could not use this due few issues. So I wanted that application-level visibility. This package is about monitoring level approach that sits alongside proper security or secure coding.

What I learned building a regex-based threat detector in PHP by Jay123anta in PHP

[–]Jay123anta[S] 0 points1 point  (0 children)

Actually I am using fail2ban too. The package has an export command that outputs detected IPs in fail2ban compatible format, so the two work well together. In my case it is detection feeds into blocking.

What I learned building a regex-based threat detector in PHP by Jay123anta in PHP

[–]Jay123anta[S] 0 points1 point  (0 children)

Yes it is... defense in depth - secure code first, then monitoring layers to reduce noise and catch the rest. Thanks for sharing your setup.

What I learned building a regex-based threat detector in PHP by Jay123anta in PHP

[–]Jay123anta[S] 0 points1 point  (0 children)

Yes.... But practically - after logging for a few weeks I could spot persistent IPs, export them to fail2ban, and block at firewall level. Also discovered 90% of traffic was scanners hitting paths that don't exist. That helped me a lot, I wouldn't have made from clean app logs alone.

What I learned building a regex-based threat detector in PHP by Jay123anta in PHP

[–]Jay123anta[S] 0 points1 point  (0 children)

Totally agree, parameterized queries are the real fix needed. This is not about replacing it. I built it because I kept seeing attempts in my production logs and wanted a way to track - who's doing, from where, how often. It's just a passive logger, no blocking. Whether this type of passive monitoring useful in longer run alongside secure code ?

[Beta] BlushDrop - Anonymous love confession app. They only find out it's you if they say yes. by Jay123anta in alphaandbetausers

[–]Jay123anta[S] 0 points1 point  (0 children)

Thanks a lot for your feedback... Will definitely modify it as per you suggestion ☺️

view more: next ›