coreruleset VS Viewfinder

--OWASP® ModSecurity Core Rule Set website

The other thing that came to my mind is the OWASP ModSecurity Core Rule Set (https://coreruleset.org/), which seems somewhat analogous to your proposal. If so, it might be worth chatting with some of the CRS maintainers about what their journey was.

I would say it depends on your version. The core rule set git repo shows REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf being in versions 3.0.2 through 3.3.4.

If your focus is on generic detection rules than a good resource to start with is the OWASP ModSecurity Core Rule Set (CRS) - However, this rule set is built for the mod_security WAF but depending on what data you get in from your customers, you might be able to forward it against your own mod_security instance and process the mod_security audit logs in Splunk without having to re-write/convert the rules.

I'm always getting great and helpful support from the CRS issue tracker: https://github.com/coreruleset/coreruleset/issues

Host-based firewalls and network firewalls won't always quite "cut it", OWASP ModSecurity is an open-source rule set for critical web applications that require an additional level of security.

Other than that we rely on quite a lot of things these days, notably ModSecurity and the OWASP Core Rule Set alongside some other heavy restricting of our apps. (the idea being that the app is safe on its own, but those act as extra layers of defense in case we fuck up something really badly in the app one day)

sudo git clone https://github.com/coreruleset/coreruleset /usr/share/modsecurity-crs

It's quite hard, because it's not just "use known vulnerabilities on this specific address" - you can block it easily, and there are projects (such as CRS: https://github.com/coreruleset/coreruleset) that tries to emulate this. It's more of combined specific attacks, which is amplified because if CloudFlare detected an attempt on a single high-profile site, then that IP address can be propagate to all of the protected properties. Combine that with how random is an address allocated in Tor, and you've got blocks without using an explicit Tor list.

Converts a document to a picture of its pages. View a document from the internet without downloading or running it on your machine, and without needing a word processor, spreadsheet app, or PDF viewer installed. This provides content disarm and reconstruction, or CDR. Also known as p2., this code is deployed commercially by Dosyago in their ViewFinder cloud browser product.

This work is based on this project on GitHub:

https://github.com/i5ik/Viewfinder

The version used in the above live demo has many advanced features (as you can see in the comparison[0]), including, Flash now as well. Thanks to the wonderful Ruffle Flash emulator project, written in Rust[1]

[0]: https://github.com/i5ik/Viewfinder/blob/boss/README.md#vf-pr...

[1]: https://github.com/ruffle-rs/ruffle

This includes a live demo on the same page. Just it "Try it now", and it will boot up a component for you to play with. I've made the Home page a list of class Adobe Flash games, that the Flash emulator project Ruffle uses for tests.

I use Ruffle to provide the flash content. It's pretty cool.

Everything should work, but you may have some issues on older browsers. It will not work without JavaScript enabled.

The browser component is based on this project:

https://github.com/i5ik/Viewfinder

but contains a bunch of enhancements, such as better streaming (using WebRTC and various tricks), Flash, and many other improvements.

If you see an issue feel free to report it to the above repo, preferably as a discussion, which just seems cooler and more lightweight.

This was all originally created as a delivery layer for a web-scraping app that was supposed to work on mobile, but became a break-out product in its own right...Break-out as in factored-out :). You can build lots of different stuff with it.[0]

The Ruffle integration functions essentially the same way as the Ruffle browser extension, so it's basically incorporating an "extension" even tho it's running Chrome headless. There's also paid options if you need that.

[0]: https://github.com/i5ik/Viewfinder#applications

Congratulations on your fantastic ViewFinder! I am using it on my old iPhone to access some modern webpages, see it in action. If only Whatsapp Web worked!

Ask me whatever you want. We can chat here, or go there:

https://github.com/i5ik/Viewfinder/discussions

or you can mail me: [email protected] ! :)