A PHP version of openRASP complete request response data capturing method

Abstract

The application aims to provide a PHP version of OpenRASP complete request response data capturing method, and belongs to the field of computers. The application solves the problem of incomplete log recording in the PHP language of OpenRASP, records the data accessed by the user each time, and meanwhile, the user can realize the individualization of the log format through the fill_json function in the self-defined HOOK function, so as to facilitate the analysis and monitoring of the relevant logs in the later period.

Description

Technical Field

[0001] This technology belongs to the field of computer science, specifically involving a PHP version of an OpenRASP complete request and response data capture method. Background Technology

[0002] Since the concept of RASP technology—that is, "the protection of application services should not rely on external systems, and applications should have the ability to protect themselves"—was proposed, many products applying RASP technology have emerged both domestically and internationally. Among them, Baidu's open-source OpenRASP is one of the more widely used commercial products. Baidu released OpenRASP in July 2017, productizing this security technology, and currently supports both Java and PHP development languages. OpenRASP uses Java Premain to hook operations into Java applications and determines attacks based on vulnerability identification rules. It uses a Java-JavaScript coding method, ensuring user-customizable configuration rules while reducing the performance overhead of RASP technology.

[0003] OpenRASP abandons the traditional firewall model that relies on request signature detection to detect attacks. Instead, it creatively uses RASP technology (Application Runtime Self-Protection) to directly inject itself into the services of the protected application, providing function-level real-time protection. It can detect / protect against unknown vulnerabilities without updating policies or upgrading the code of the protected application, making it particularly suitable for internet applications that use a large number of open-source components and financial applications developed by third-party integrators.

[0004] Furthermore, OpenRASP's IAST solution represents a revolutionary improvement over traditional DAST solutions. Vulnerability detection eliminates the need for dynamic crawlers or bypass proxies, resulting in more comprehensive scanning. Combined with application probes, it accurately identifies vulnerability types, significantly improving detection efficiency through targeted scanning.

[0005] However, OpenRASP currently does not record all logs during operation, only these four types of logs: plugin detection logs, debugging logs, attack alert logs, and security baseline check alert logs. These four types of log information are not comprehensive. They do not record database-related data in the application response, and the HTTP request content is incomplete and the response content is not recorded. These logs are not sufficient for technicians to understand the detailed information of the attack and thus develop corresponding defense methods.

[0006] Purpose of the invention

[0007] The purpose of this invention is to provide a PHP version of the OpenRASP complete request and response data capture method to solve the problem of incomplete logging in the PHP language of OpenRASP.

[0008] Technical solution

[0009] The purpose of this invention is achieved as follows:

[0010] This invention proposes a PHP-based method for capturing complete OpenRASP request and response data. The specific implementation steps are as follows:

[0011] Step 1: Add the fill_json method to the V8Material class, with the parameter being a JsonReader class, to write the properties of the current class into the passed-in JSON class;

[0012] Step 2: For all entities used in the HOOK point, override the fill_json method in a subclass that inherits from the V8Material class, and let the user define the relevant format to put the information in the currently detected entity into the JsonReader class;

[0013] Step 3: Create a Response class to store the response data of the PHP request, and create a Session class to store all the information of the request. Modify the Parameter class, add properties to store the GET and POST parameters of the request, and assign values ​​to them in the extended startup class in the openrasp.cc file. In the Response class, use a Map data structure to store the response header of the request, and use a JsonReader to store other response information of the request, including MySQL data or file operation records. In the Session class, to ensure that the logs obtained by PHP at each stage when recording access logs belong to the same request, use a Map to store the request and response data, with the key of the Map being the thread ID.

[0014] Step 4: Modify the JsonReader class to add the write_sql_result method that writes list data from the database to the current class; create a global Session class and put the Session class into PHP's global variables so that any function can access it from any location;

[0015] Step 5: Analyze the subclass entities of the V8Material class in the intercept functions of various PHP functions in the HOOK file. After these entities are created and the required properties are assigned values, save the properties of the class to the JsonReader class in the Response of the current thread through the global Session class. The retrieval of MySQL query data requires parsing and retrieving the database data in the post-HOOK function of the PHP database query-related function, and restoring the modified data after the database data is obtained. The retrieval process is mainly implemented by calling relevant PHP functions.

[0016] Step 6: In the openrasp_log.cc log file, specify the custom log folder and filename, and generate different log files according to the date. At the same time, in the extended close function of this class, output the log to the specified file. Before printing, you need to obtain the response header information of the Response, indicating that the request is about to be completed and the response header is generated.

[0017] Furthermore, each step saves all data from each PHP request.

[0018] Compared with existing technologies, the advantages of this invention are: it solves the problem of incomplete logging in the PHP language of OpenRASP, and records data accessed by the user for each request. Furthermore, users can personalize the log format through the `fill_json` function in the custom hook function, facilitating subsequent log analysis and monitoring. This invention allows technicians to understand detailed attack information, enabling them to develop corresponding defense methods. Attached Figure Description

[0019] Figure 1 This is a diagram showing the inheritance relationships between some of the classes to be modified and their corresponding attributes.

[0020] Figure 2 A flowchart for obtaining MySQL query data;

[0021] Figure 3 A diagram showing the attributes of the Parameter, Session, and Response classes required for the request;

[0022] Figure 4 This is a flowchart of the overall project process. Detailed Implementation

[0023] The present invention will now be further described with reference to the accompanying drawings.

[0024] This invention proposes a PHP-based method for capturing complete OpenRASP request and response data. The specific implementation steps are as follows:

[0025] Step 1: Add the fill_json method to the V8Material class, with a JsonReader class as the parameter, to make it easier to write the properties of the current class into the passed JSON class.

[0026] Step 2: For all entities used in the hook point, override the `fill_json` method in a subclass that inherits from `V8Material`, and allow the user to define the relevant format. Place the information from the currently detected entity into the `JsonReader` class. Partial inheritance relationships are shown in the appendix. Figure 1 As shown.

[0027] Step 3: Create a Response class to store the response data of the PHP request, and create a Session class to store all request information. Modify the Parameter class, add properties to save the GET and POST parameters of the request, and in the extended startup class of the openrasp.cc file, use the PHP global access macro PG to retrieve the request parameters and save them to the Parameter class. The relevant class properties are attached. Figure 2 As shown. In the Response class, a Map data structure is used to store the request's response headers, and a JsonReader is used to store other response information, including MySQL data or file operation records. In the Session class, to ensure that the logs obtained by PHP at each stage belong to the same request, we use a Map to store the request and response data. The key of the Map is the thread ID, which can be obtained by calling the PHP method getmypid. HTTP response header information can be obtained using the PHP global access macro SG.

[0028] Step 4: Modify the JsonReader class to add the write_sql_result method, which writes list data from the database to the current class; create a global Session class and put it into PHP's global variables so that any function can access it from any location. That is, create the Session class after the global variable declaration macro ZEND_BEGIN_MODULE_GLOBALS in the openrasp.h file.

[0029] Step 5: By analyzing the subclass entities of the V8Material class in the intercept functions of various PHP functions in the hook file, once these entities are created and all required properties have been assigned values, the properties of this class are saved to the JsonReader class in the Response of the current thread through the global Session class. Retrieving MySQL query data is more complex. It requires parsing and retrieving the database data in the post-hook function of the PHP database query-related functions, and then restoring the modified data after retrieving the database data. The retrieval process is mainly implemented by calling relevant PHP functions. The implementation process for retrieving MySQL data is shown in the attached figure. Figure 3 As shown, the processing of other databases is similar, only the PHP functions called are different.

[0030] Step 6: In the openrasp_log.cc log file, specify the folder and filename for the custom log file so that it can automatically generate different log files based on the date. Simultaneously, use the global logging macro LOG_G in the extended close function of this class to output the logs to the specified file. Before printing, it is necessary to obtain the response header information, because the response header is only generated when the request is about to complete. The overall process is attached. Figure 4 As shown.

[0031] By following the steps above, all data from each PHP request can be saved, allowing technical personnel to understand the detailed information of the attack and thus develop corresponding defense methods.

[0032] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A PHP-based method for capturing complete OpenRASP request and response data, characterized in that: The specific steps are as follows: Step 1: Add the fill_json method to the V8Material class, with the parameter being a JsonReader class, to write the properties of the current class into the passed-in JSON class; Step 2: For all entities used in the HOOK point, override the fill_json method in a subclass that inherits from the V8Material class, and let the user define the relevant format to put the information in the currently detected entity into the JsonReader class; Step 3: Create a Response class to store the response data of the PHP request, and create a Session class to store all the information of the request. Modify the Parameter class, add properties to store the GET and POST parameters of the request, and assign values ​​to them in the extended startup class in the openrasp.cc file. In the Response class, use a Map data structure to store the response header of the request, and use a JsonReader to store other response information of the request, including MySQL data or file operation records. In the Session class, to ensure that the logs obtained by PHP at each stage when recording access logs belong to the same request, use a Map to store the request and response data, with the key of the Map being the thread ID. Step 4: Modify the JsonReader class to add the write_sql_result method, which writes list data from the database to the current class. Create a global Session class and put it into a global variable in PHP so that any function can access it from any location; Step 5: Analyze the subclass entities of the V8Material class in the intercept functions of various PHP functions in the HOOK file. After these entities are created and the required properties are assigned values, save the properties of the class to the JsonReader class in the Response of the current thread through the global Session class. The retrieval of MySQL query data requires parsing and retrieving the database data in the post-HOOK function of the PHP database query-related function, and restoring the modified data after the database data is obtained. The retrieval process is mainly implemented by calling relevant PHP functions. Step 6: In the openrasp_log.cc log file, specify the custom log folder and filename, and generate different log files according to the date. At the same time, in the extended close function of this class, output the log to the specified file. Before printing, you need to obtain the response header information of the Response, indicating that the request is about to be completed and the response header is generated.

2. The method for capturing complete request and response data in PHP version of OpenRASP according to claim 1, characterized in that: Each step saves all data from each PHP request.

Images