{"id":4112,"date":"2016-03-22T03:14:43","date_gmt":"2016-03-21T19:14:43","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=4112"},"modified":"2016-03-22T03:15:48","modified_gmt":"2016-03-21T19:15:48","slug":"naxsi-open-source-waf-nginx","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2016\/03\/naxsi-open-source-waf-nginx\/","title":{"rendered":"NAXSI &#8211; Open-Source WAF For Nginx"},"content":{"rendered":"<p>NAXSI is an open-source WAF for Nginx (<strong>W<\/strong>eb <strong>A<\/strong>pplication <strong>F<\/strong>irewall) which by default can block 99% of known patterns involved in website vulnerabilities. NAXSI means <strong>N<\/strong>ginx <strong>A<\/strong>nti <strong>X<\/strong>SS &#038; <strong>S<\/strong>QL <strong>I<\/strong>njection<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2016\/03\/naxsi-640x413.jpg\" alt=\"NAXSI - Open-Source WAF For Nginx\" width=\"640\" height=\"413\" class=\"aligncenter size-medium wp-image-4113\" srcset=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2016\/03\/naxsi-640x413.jpg 640w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2016\/03\/naxsi.jpg 668w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<p>Technically, it is a third party Nginx module, available as a package for many UNIX-like platforms. This module, by default, reads a small subset of simple (and readable) rules containing 99% of known patterns involved in websites vulnerabilities. For example, <code><<\/code>, <code>|<\/code> or <code>drop<\/code> are not supposed to be part of a URI.<\/p>\n<p>Being very simple, those patterns may match legitimate queries, it is NAXSI's administrator duty to add specific rules that will whitelist those legitimate behaviours. The administrator can either add whitelists manually by analyzing Nginx's error log, or (recommended) start the project by an intensive auto-learning phase that will automatically generate whitelisting rules regarding website's behaviour.<\/p>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<p>In short, NAXSI behaves like a DROP-by-default firewall, the only job needed is to add required ACCEPT rules for the target website to work properly. I love Nginx and use it for everything, so having a bit of extra protection for it, without too much hassle is great.<\/p>\n<h3>Why is it Different?<\/h3>\n<p>On the contrary of most Web Application Firewall, Naxsi doesn't rely on a signature base, like an antivirus, and thus cannot be circumvented by an \"unknown\" attack pattern. Another main difference between NAXSI and other WAF, NAXSI filters only GET and POST resquests, is a Free software (as in freedom) and free (as in free beer) to use.<\/p>\n<p>Do note though, this model requires a bit more effort as you have to whitelist to get things to work but it will block more obfuscated and uncommon attacks without updates or modifications.<\/p>\n<p>You can download the latest version of the module source code here:<\/p>\n<p><a href=\"https:\/\/github.com\/nbs-system\/naxsi\/archive\/0.54.zip\">naxsi-0.54.zip<\/a><\/p>\n<p>But it's most easily installed with an optional distro friendly NAXSI included version of Nginx, which you just need to tweak the config for. On Ubuntu systems for example you'd just do:<\/p>\n<pre>aptitude install nginx-naxsi<\/pre>\n<p>One downside of this is you won't get the newest version of NAXSI (or most likely the latest Nginx either) but it will be stable. As Nginx doesn't support runtime module loading you can't update NAXSI outside of recompiling Nginx (not ideal).<\/p>\n<p>You can also read more <a href=\"https:\/\/github.com\/nbs-system\/naxsi\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>NAXSI is an open-source WAF for Nginx (Web Application Firewall) which by default can block 99% of known patterns involved in website vulnerabilities. NAXSI means Nginx Anti XSS &#038; SQL Injection Technically, it is a third party Nginx module, available as a package for many UNIX-like platforms. This module, by default, reads a small subset [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"NAXSI is an open-source WAF for Nginx (Web Application Firewall) which by default can block 99% of known patterns involved in website vulnerabilities.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[12,11],"tags":[8724,4784],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/4112"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=4112"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/4112\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=4112"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=4112"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=4112"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}