How to detect if bot is scanning ports - php

Is there a way to detect if a bot is scanning your website/server for open ports with PHP? I googled this but i only found scripts to make a port scanner with php.

PHP is probably not the best language to do this as PHP mainly just meant to run whenever a client makes a request.
I imagine you'd need to interface with the OS directly to do this to capture network traffic on specific ports, which isn't one of PHPs strongsuits either.
You can then either try to inspect the incoming payload and determine whether it is a port scanner. Or you could keep a log with to count the total amount of different ports a single machine has connected to and block based on that.

Related

remote rendering of PHP file

this question might quite possibly not have an answer or be quite stupid. I guess we will find out.
My situation is the following:
I am wokring with an embedded device. On the embedded device there
are 10-20 webservices running -- you can actually imagine small
webservers. Each of them is on its own port. This one might have the IP 152.0.0.1
A top-level web-interface is wrapped around these webservices. This
webinterface runs on a standard LEMP setup (debian). Say this has the IP 10.0.0.1
To work on the embedded device one can locally jump from webservice to webservice by calling 152.0.0.1:xxxx, 152.0.0.1:xxxy, 152.0.0.1:xxxz in a (local) webbrowser. This works fine. It seems crazy to have a setup like this but I do not have the possiblity to change things on this end.
What I would like to do is to embed the small webservices in the top-level webinterface, which will have a navigation bar where one can chose which one to look at.
Both systems are not in the same network but connected via a ssh tunnel. However, the ports themselves are dynamic, so I can not simply hard-code them in the top-level web-interface. I should be able by building the navbar using dynamic ports obtained from a database -- this is possible. Since there will be multiple such embedded devices there will be multiple ports to forward with the ssh connection. This is the problematic part.
My question is: is there actually a way to get rid on this port-dilemma situation only on the nginx/php7 level? The embedded device should keep its own ports but I would not want to call them explicitely from the webinterface. Also, each device having a set of ports is quite cumbersome. I could use nginx reverse proxy to map the ports to URLs but I would have to do that on the embedded hardware, which is complicated. I could do it on the debian server as well using nginx but this means I would have to forward a whole bunch of ports from the embedded device to the debian server, which is not nice.
Is there a way I can make the embedded device build a page all on its own, using its internal port-scheme and then display that on the top-level webinterface? I am thinking about a command which allows me to do so, e.g.
buildpage($device, $port) on the embedded device alone and "forward" the entire content of that built webpage to the top-level webinterface. The top-level webinterface would then never have to deal with the port-confusion on the embedded device, it just has to say which port it should use, the embedded device internally pre-renders the page and sends it to the top-level webinterface. The point here being, the aforementioned ssh tunnel would not have to forward a whole bunch of ports anymore but possibly onlyone -- wich is the ultimate goal!
I might be overseeing an easy solution here and the approach probably does not make all that much sense but please consider it. In case there is a better option, I would be very keen to know.
Thank you a lot

Best strategy for sending commands to Arduino: Send UDP packet OR get configuration from a dynamic web page?

I would like to send some configuration parameters to an Arduino Ethernet board, and I came up with two potential solutions. I would be grateful if you could give your thoughts on using either one of those.
The first (obvious) option is to send a UDP command containing the configuration to the Arduino. This, however, requires a reconfiguration for most routers to enable port-forwarding or disabling the firewall.
So my second option is to get the configuration by accessing a web page from Ardino which will contain all the required information (this will be updated using a PHP script on the server). This page will be checked every minute or so and update the configuration if a new one is found. The requirement for communication every minute is not a problem since there is also traffic on the other direction (my Arduino logs temperatures in a web site).
Which method is the best and are there any pitfalls I should avoid?
I recently finished my WebPlayer.ino where it got pushed commands over the web as to what files to play from the SD card to the MP3 chip, along with volume and speed control. Similar to your goals, I had to pull a bunch of pieces from all over into it. So it may be a nice example of how to parse the web commands.
In either UDP or TCP and using the native Ethernet library, one needs to read the character string from the ethernet.client. Regardless of direction and TCP vs UDP. The one advantage I have seen with UDP is that there are some examples using the "String" type to get the data as a whole, but that is insignificant. I would stick with TCP, look at my example as how to read the web servers requests.
Additionally, the Webduino library is a wrapper that simplifies getting the commands. It provides JSON and the like. So that would be very useful for what your doing. But it uses a huge chunk of RAM and ROM. Hence my project did not use it.

Getting information from a DNS or DHCP Server

I'm making a network monitoring program with PHP.
I want to be able to connect to the DNS or DHCP Server and get all of the computers that belong to the network.
Currently I'm running nested for loops to ping every possible IP Address however it takes way to long with over 10 subnets.
I'm trying to change from doing it like a noob to doing it like a boss.
I want to get a list of all computer names and IP Addresses as well as if their IP was assigned Dynamically or Statically.
How should I do this?
There is no way to enumerate all hosts on a network, even pinging all of them isn't sufficient as some may not reply to ping. For the dynamically allocated ones you could query the DHCP server, but DHCP as a protocol does not support this, you'd have to write a daemon process and query the logs or assignment file.
If you do want to do it by pinging I'd suggest writing a small program the runs in the background and pings everything, keeping the results in memory, and then have your php script query that. This way you response time will be near immediate. So long as hosts don't appear and disappear too frequently (sounds unlikely) then this should be fine.

How to read tcp/ip headers in PHP?

I want to get the source endpoint .
Basically i want to block some ips by geting the port/ip from tcp/ip headers not from http header. Are there any built in methods for PHP to achieve that or i should do a workaround ?
If you are just looking to block some IP from your website the $_SERVER['REMOTE_ADDR'] variable holds the IP. If you need to block the request before it even gets to your webserver, GordonM is right, a firewall is what you need.
PHP is too high up the networking stack to do this. Once the PHP script starts the connection is already initiated. If you want to block certain IP/port combinations then you have to do it at a lower level in the network stack. A firewall is built for exactly this job, you need to set one up to enforce the restrictions you want.

Is it possible to have a peer to peer communication using nothing but PHP

Is it possible to implement a p2p using just PHP? Without Flash or Java and obviously without installing some sort of agent/client on one's computer.
so even though it might not be "true" p2p, but it'd use server to establish connection of some sort, but rest of communication must be done using p2p
i apologize for little miscommunication, by "php" i meant not a php binary, but a php script that hosted on web server remote from both peers, so each peer have nothing but a browser.
without installing some sort of
agent/client on one's computer
Each computer would have to have the PHP binaries installed.
EDIT
I see in a different post you mentioned browser based. Security restrictions in javascript would prohibit this type of interaction
No.
You could write a P2P client / server in PHP — but it would have to be installed on the participating computers.
You can't have PHP running on a webserver cause two other computers to communicate with each other without having P2P software installed.
You can't even use JavaScript to help — the same origin policy would prevent it.
JavaScript running a browser could use a PHP based server as a middleman so that two clients could communicate — but you aren't going to achieve P2P.
Since 2009 (when this answer was originally written), the WebRTC protocol was written and achieved widespread support among browsers.
This allows you to perform peer-to-peer between web browsers but you need to write the code in JavaScript (WebAssembly might also be an option and one that would let you write PHP.)
You also need a bunch of non-peer server code to support WebRTC (e.g. for allow peer discovery and proxy data around firewalls) which you could write in PHP.
It is non-theoretical because server side application(PHP) does not have peer's system access which is required to define ports, IP addresses, etc in order to establish a socket connection.
ADDITION:
But if you were to go with PHP in each peer's web servers, that may give you what you're looking for.
Doesn't peer-to-peer communication imply that communication is going directly from one client to another, without any servers in the middle? Since PHP is a server-based software, I don't think any program you write on it can be considered true p2p.
However, if you want to enable client to client communications with a php server as the middle man, that's definitely possible.
Depends on if you want the browser to be sending data to this PHP application.
I've made IRC bots entirely in PHP though, which showed their status and output in my web browser in a fashion much like mIRC. I just set the timeout limit to infinite and connected to the IRC server using sockets. You could connect to anything though. You can even make it listen for incoming connections and handle them.
What you can't do is to get a browser to keep a two-way connection without breaking off requests (not yet anyways...)
Yes, but its not what's generally called p2p, since there is a server in between. I have a feeling though that what you want to do is to have your peers communicate with each other, rather than have a direct connection between them with no 'middleman' server (which is what is normally meant by p2p)
Depending on the scalability requirements, implementing this kind of communication can be trivial (simple polling script on clients), or demanding (asynchronous comet server).
In case someone comes here seeing if you can write P2P software in PHP, the answer is yes, in this case, Quentin's answer to the original question is correct, PHP would have to be installed on the computer.
You can do whatever you want to do in PHP, including writing true p2p software. To create a true P2P program in PHP, you would use PHP as an interpreted language WITHOUT a web server, and you would use sockets - just like you would in c/c++. The original accepted answer is right and wrong, unless however the original poster was asking if PHP running on a webserver could be a p2p client - which would of course be no.
Basically to do this, you'd basically write a php script that:
Opens a server socket connection (stream_socket_server/socket_create)
Find a list of peer IP's
Open a client connection to each peer
...
Prove everyone wrong.
No, not really. PHP scripts are meant to run only for very small amount of time. Usually the default maximum runtime is two minutes which will be normally not enough for p2p communication. After this the script will be canceled though the server administrator can deactivate that. But even then the whole downloading time the http connection between the server and the client must be hold. The client's browser will show in this time its page loading indicator. If the connection breakes most web servers will kill the php script so the p2p download is canceled.
So it may be possible to implement the p2p protocol, but in a client/server scenario you run into problems with the execution model of php scripts.
both parties would need to be running a server such as apache although for demonstration purposes you could get away with just using the inbuilt php test server. Next you are going to have to research firewall hole punching in php I saw a script i think on github but was long time ago . Yes it can be done , if your client is not a savvy programmer type you would probably need to ensure that they have php installed and running. The path variable may not work unless you add it to the system registry in windows so make sure you provide a bat file that both would ensure the path is in the system registry so windows can find it .Sorry I am not a linux user.
Next you have to develop the code. There are instrucions for how hole punching works and it does require a server on the public domain which is required to allow 2 computers to find each others ip address. Maybe you could rig up something on a free website such as www.000.webhost.com alternatively you could use some kind of a built in mechanism such as using the persons email address. To report the current ip.
The biggest problem is routers and firewalls but packets even if they are directed at a public ip still need to know the destination on a lan so the information on how to write the packet should be straight forwards. With any luck you might find a script that has done most of the work for you.

Categories