Download the PHP package bitsensor/php without Composer
On this page you can find all versions of the php package bitsensor/php. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download bitsensor/php
More information about bitsensor/php
Files in bitsensor/php
Package php
Short Description BitSensor Web Application Security
License MIT
Homepage https://bitsensor.io/
Informations about the package php
BitSensor PHP Plugin
The BitSensor PHP plugin.
Setup BitSensor
Requirements
php >= 5.6.0
composer
uopz
[optional, for query tracing]
Installation
Configuration
Code
JSON
index.php
Sample configuration file:
Documentation
You have the following config options at your disposal:
PHP | JSON | Value | Default | Description |
---|---|---|---|---|
mode | ("ids"), ("monitoring"), ("off") | ("ids") | BitSensor pipeline running mode. Default "ids" mode includes process pipeline, false positive detection, auto-blocking. "monitoring" mode excludes auto-blocking while in "off" mode, only logging will be done | |
ipAddressSrc | ("remoteAddr"), ("forwardedFor"), ("manual") | ("remoteAddr") | Source of the IP address of the user. | |
ipAddress | ip override | IP address manual override value. | ||
hostSrc | ("serverName"), ("hostHeader"), ("manual") | ("serverName") | Source of the hostname. | |
host | host address override | Hostname manual override value. | ||
logLevel | ("all"), ("none") | ("all") | The logging level. | |
outputFlushing | ("on"), ("off") | ("off") | Output flushing. Turning this on allows the browser to render the page while BitSensor is still working in the background. | |
uopzHook | ("on"), ("off") | ("on") | Uopz Hooking. Turning this on enables BitSensor to hook into function calls. | |
executeFastCgi | ("on"), ("off") | ("off") | Finish request to your FastCGI webserver, while processing BitSensor in a separate thread. |
Connector Types
Api
PHP | JSON | Value | Default | Description |
---|---|---|---|---|
user | username | Your BitSensor username. | ||
apikey | api key | Your BitSensor API key. | ||
host | hostname | {user}.bitsensor.io | Hostname of the BitSensor endpoint. | |
port | port | 8080 | Port of the BitSensor endpoint. |
File
PHP | JSON | Value | Default | Description |
---|---|---|---|---|
filename | File to write to | /var/log/bitsensor-datapoints-php.log | Logfile that is appended to. Make sure that the Apache or Nginx user can write to this file. Set this using touch /var/log/bitsensor-datapoints-php.log; chown www-data /var/log/bitsensor-datapoints-php.log; chmod 200 /var/log/bitsensor-datapoints-php.log |
Blocking Actions
Blockingpage
PHP | JSON | Value | Default | Description |
---|---|---|---|---|
user | username | Your BitSensor username. | ||
host | hostname | {user}.bitsensor.io | Hostname of the BitSensor endpoint. | |
port | port | 2080 | Port of the BitSensor endpoint. |
Query tracing
To use PDO and MySQLi query tracing, the uopz pecl extension must be installed.
Logging
Monolog
Tags
If you are running many applications, it might be sensible to group them by a tag. You can create a tag using the following snippet:
WebSocket
If you are using websockets, BitSensor needs to know in order to properly detect attacks.
Apache
After sinking BitSensor hooks in your application, you can extend BitSensor's visibility to include Apache events that aren't processed by your application.
To log Apache errors add the following to your .htaccess
:
Debugging
For more extensive debugging in your codebase, we provide the following hooks:
Debug logging can be printed using BitSensor\Util\Log::d($msg)
,
this will only be printed when running in debug mode, activated by setting:
This should be done in a test script and not in the actual source.
External dependencies
Libraries not managed by Composer should go in the lib/
folder.