JoshS/Cloudflare-WAF-To-AbuseIPDB
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Some fixes

Browse source
This commit is contained in:
Sefinek 2024-11-10 01:13:11 +01:00
parent ea8e6a3b28
commit daab46d4ec
5 changed files with 18 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -1,4 +1,4 @@
# Cloudflare WAF to AbuseIPDB 🕵️‍♀️
# Cloudflare WAF to AbuseIPDB ☁️🕵️
This project offers an automated script that collects and reports IP addresses that have triggered Cloudflare firewall events.
In simple terms, it enables the reporting of incidents detected by Cloudflare WAF to the AbuseIPDB database.

2
index.js
View file

@ -1,7 +1,7 @@
require('dotenv').config();
const { axios, moduleVersion } = require('./services/axios.js');
const { CYCLE_INTERVAL, REPORTED_IP_COOLDOWN_MS, MAX_URL_LENGTH, SUCCESS_COOLDOWN, SEFINEK_API_INTERVAL, REPORT_TO_SEFINEK_API } = require('./config.js');
const { CYCLE_INTERVAL, REPORTED_IP_COOLDOWN_MS, MAX_URL_LENGTH, SUCCESS_COOLDOWN, SEFINEK_API_INTERVAL, REPORT_TO_SEFINEK_API } = require('./scripts/config.js');
const PAYLOAD = require('./scripts/payload.js');
const generateComment = require('./scripts/generateComment.js');
const SefinekAPI = require('./scripts/sefinekAPI.js');

2
scripts/clientIp.js
View file

@ -1,5 +1,5 @@
const { axios } = require('../services/axios.js');
const { IP_REFRESH_INTERVAL } = require('../config.js');
const { IP_REFRESH_INTERVAL } = require('./config.js');
const log = require('./log.js');
let address = null; // Holds the IP address

0
config.js → scripts/config.js
View file

30
scripts/generateComment.js
View file

@ -1,23 +1,23 @@
module.exports = it => {
module.exports = ({ action, clientAsn, clientASNDescription, clientRequestHTTPProtocol, clientRequestHTTPMethodName, clientRequestHTTPHost, clientRequestPath, clientRequestQuery, datetime, rayName, ruleId, userAgent = 'Empty string', source, clientCountryName }) => {
const fields = [
{ label: 'Action taken', value: it.action?.toUpperCase() },
{ label: 'ASN', value: `${it.clientAsn} (${it.clientASNDescription})` },
{ label: 'Protocol', value: `${it.clientRequestHTTPProtocol} (method ${it.clientRequestHTTPMethodName})` },
{ label: 'Domain', value: it.clientRequestHTTPHost },
{ label: 'Endpoint', value: it.clientRequestPath },
{ label: 'Query', value: it.clientRequestQuery },
{ label: 'Timestamp', value: it.datetime },
{ label: 'Ray ID', value: it.rayName },
{ label: 'Rule ID', value: it.ruleId },
{ label: 'UA', value: it.userAgent || 'Empty string' },
{ label: 'Action taken', value: action?.toUpperCase() },
{ label: 'ASN', value: `${clientAsn} (${clientASNDescription})` },
{ label: 'Protocol', value: `${clientRequestHTTPProtocol} (method ${clientRequestHTTPMethodName})` },
{ label: 'Domain', value: clientRequestHTTPHost },
{ label: 'Endpoint', value: clientRequestPath },
{ label: 'Query', value: clientRequestQuery },
{ label: 'Timestamp', value: datetime },
{ label: 'Ray ID', value: rayName },
{ label: 'Rule ID', value: ruleId },
{ label: 'UA', value: userAgent },
];
const reportLines = fields
.filter(field => field.value)
.map(field => `${field.label}: ${field.value}`);
.filter(({ value }) => value)
.map(({ label, value }) => `${label}: ${value}`);
return `Triggered Cloudflare WAF (${it.source}) from ${it.clientCountryName}.
return `Triggered Cloudflare WAF (${source}) from ${clientCountryName}.
${reportLines.join('\n')}
Report generated by Cloudflare-WAF-To-AbuseIPDB https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB`;
Report generated by Cloudflare-WAF-To-AbuseIPDB: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB`;
};