| .github/ISSUE_TEMPLATE | ||
| backend | ||
| blazehttp@23e8b59cd2 | ||
| blockpage | ||
| documents | ||
| images | ||
| lua-resty-t1k@6446166301 | ||
| plugins@209e7c0e00 | ||
| release | ||
| website | ||
| yanshi | ||
| .dockerignore | ||
| .gitignore | ||
| .gitmodules | ||
| CHANGELOG.md | ||
| Dockerfile | ||
| FAQ.md | ||
| LICENSE.md | ||
| README.md | ||
| README_CN.md | ||
SafeLine, the best free WAF for webmaster
SafeLine is a web security gateway to protect your websites from attacks and exploits.
It defenses for all of web attacks, such as sql injection, code injection, os command injection, CRLF injection, ldap injection, xpath injection, rce, xss, xxe, ssrf, path traversal, backdoor, bruteforce, http-flood, bot abused and so on.
🏠Home | 📖Documentation | 🔍Live Demo | 中文版
Screenshots
How It Works
SafeLine is developed based on nginx, it serves as a reverse proxy middleware to detect and cleans web attacks, its core capabilities include:
- Defenses for web attacks
- Proactive bot abused defense
- HTML & JS code encryption
- IP-based rate limiting
- Web Access Control List
Installation
中国大陆用户安装国际版可能会导致无法连接云服务，请查看 中文版安装文档
Automatic Deploy
👍Recommended
Use the following command to start the automated installation of SafeLine. (This process requires root privileges)
bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/setup.sh)"
After the command is executed, it means the installation is successfully. Please go to "Use Web UI" directly.
Mannually Deploy
to see Documentation
Usage
Login
Open the web console page https://<safeline-ip>:9443/ in the browser, then you will see below.
Execute the following command to get administrator account
docker exec safeline-mgt /app/mgt-cli reset-admin --once
After the command is successfully executed, you will see the following content
Please must remember this content
[SafeLine] Initial username：admin
[SafeLine] Initial password：**********
[SafeLine] Done
Enter the password in the previous step and you will successfully logged into SafeLine.
Protecting a website
Log into the SafeLine Web Admin Console, go to the "Site" -> "Website" page and click the "Add Site" button in the upper right corner.
In the next dialog box, enter the information to the original website.
- Domain: domain name of your original website, or hostname, or ip address, for example:
www.chaitin.com - Port: port that SafeLine will listen, such as 80 or 443. (for
httpswebsites, please check theSSLoption) - Upstream: real address of your original website, through which SafeLine will forward traffic to it
After completing the above settings, please resolve the domain name you just entered to the IP address of the server where SafeLine is located.
Then you can access the website protected by the SafeLine through the domain name like this.
Try to attack your website
Now, your website is protected by SafeLine, let’s try tp attack it and see what happens.
If https://chaitin.com is a website protected by SafeLine, here are some test cases for common attacks:
- SQL Injection:
https://chaitin.com/?id=1+and+1=2+union+select+1 - XSS:
https://chaitin.com/?id=<img+src=x+onerror=alert()> - Path Traversal:
https://chaitin.com/?id=../../../../etc/passwd - Code Injection:
https://chaitin.com/?id=phpinfo();system('id') - XXE:
https://chaitin.com/?id=<?xml+version="1.0"?><!DOCTYPE+foo+SYSTEM+"">
Replace chaitin.com in the above cases with your website domain name and try to access it.
Check the web console of SafeLine to see the attack list
To view the specific details of the attack, click "detail"
Star History
Related Repo
Automaton Generator | Lua Plugin | T1K Protocol | WAF Test Tool