JoshS/Cloudflare-WAF-To-AbuseIPDB
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Some fixes

Browse source
This commit is contained in:
Sefinek 2024-11-10 01:13:11 +01:00
parent ea8e6a3b28
commit daab46d4ec
5 changed files with 18 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -1,4 +1,4 @@
# Cloudflare WAF to AbuseIPDB 🕵️‍♀️ # Cloudflare WAF to AbuseIPDB ☁️🕵️
This project offers an automated script that collects and reports IP addresses that have triggered Cloudflare firewall events. This project offers an automated script that collects and reports IP addresses that have triggered Cloudflare firewall events.
In simple terms, it enables the reporting of incidents detected by Cloudflare WAF to the AbuseIPDB database. In simple terms, it enables the reporting of incidents detected by Cloudflare WAF to the AbuseIPDB database.

2
index.js
View file

@ -1,7 +1,7 @@
require('dotenv').config(); require('dotenv').config();
const { axios, moduleVersion } = require('./services/axios.js'); const { axios, moduleVersion } = require('./services/axios.js');
const { CYCLE_INTERVAL, REPORTED_IP_COOLDOWN_MS, MAX_URL_LENGTH, SUCCESS_COOLDOWN, SEFINEK_API_INTERVAL, REPORT_TO_SEFINEK_API } = require('./config.js'); const { CYCLE_INTERVAL, REPORTED_IP_COOLDOWN_MS, MAX_URL_LENGTH, SUCCESS_COOLDOWN, SEFINEK_API_INTERVAL, REPORT_TO_SEFINEK_API } = require('./scripts/config.js');
const PAYLOAD = require('./scripts/payload.js'); const PAYLOAD = require('./scripts/payload.js');
const generateComment = require('./scripts/generateComment.js'); const generateComment = require('./scripts/generateComment.js');
const SefinekAPI = require('./scripts/sefinekAPI.js'); const SefinekAPI = require('./scripts/sefinekAPI.js');

2
scripts/clientIp.js
View file

@ -1,5 +1,5 @@
const { axios } = require('../services/axios.js'); const { axios } = require('../services/axios.js');
const { IP_REFRESH_INTERVAL } = require('../config.js'); const { IP_REFRESH_INTERVAL } = require('./config.js');
const log = require('./log.js'); const log = require('./log.js');
let address = null; // Holds the IP address let address = null; // Holds the IP address

0
config.js → scripts/config.js
View file

30
scripts/generateComment.js
View file

@ -1,23 +1,23 @@
module.exports = it => { module.exports = ({ action, clientAsn, clientASNDescription, clientRequestHTTPProtocol, clientRequestHTTPMethodName, clientRequestHTTPHost, clientRequestPath, clientRequestQuery, datetime, rayName, ruleId, userAgent = 'Empty string', source, clientCountryName }) => {
const fields = [ const fields = [
{ label: 'Action taken', value: it.action?.toUpperCase() }, { label: 'Action taken', value: action?.toUpperCase() },
{ label: 'ASN', value: `${it.clientAsn} (${it.clientASNDescription})` }, { label: 'ASN', value: `${clientAsn} (${clientASNDescription})` },
{ label: 'Protocol', value: `${it.clientRequestHTTPProtocol} (method ${it.clientRequestHTTPMethodName})` }, { label: 'Protocol', value: `${clientRequestHTTPProtocol} (method ${clientRequestHTTPMethodName})` },
{ label: 'Domain', value: it.clientRequestHTTPHost }, { label: 'Domain', value: clientRequestHTTPHost },
{ label: 'Endpoint', value: it.clientRequestPath }, { label: 'Endpoint', value: clientRequestPath },
{ label: 'Query', value: it.clientRequestQuery }, { label: 'Query', value: clientRequestQuery },
{ label: 'Timestamp', value: it.datetime }, { label: 'Timestamp', value: datetime },
{ label: 'Ray ID', value: it.rayName }, { label: 'Ray ID', value: rayName },
{ label: 'Rule ID', value: it.ruleId }, { label: 'Rule ID', value: ruleId },
{ label: 'UA', value: it.userAgent || 'Empty string' }, { label: 'UA', value: userAgent },
]; ];
const reportLines = fields const reportLines = fields
.filter(field => field.value) .filter(({ value }) => value)
.map(field => `${field.label}: ${field.value}`); .map(({ label, value }) => `${label}: ${value}`);
return `Triggered Cloudflare WAF (${it.source}) from ${it.clientCountryName}. return `Triggered Cloudflare WAF (${source}) from ${clientCountryName}.
${reportLines.join('\n')} ${reportLines.join('\n')}
Report generated by Cloudflare-WAF-To-AbuseIPDB https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB`; Report generated by Cloudflare-WAF-To-AbuseIPDB: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB`;
}; };