=== WebRanger === Copyright (c) 2015 Pandora Security Labs Author: Dominic Lucenario Contributors: domlucenario, Edison Pama, Jeno Rigor Tags: web application security, siem, webranger, exploit, sql injection, xss, hack, protection, vulnerability, web application firewall, owasp top ten Requires at least: 3.4 Tested up to: 4.4 Stable tag: 1.0.0 License: GPLv3 License URI: https://www.gnu.org/licenses/gpl.txt WebRanger protects your web application in real-time by identifying attacks and reporting them through a separate console. == Description == WebRanger starts by reviewing each HTTP request from your visitors and scanning them for malicious signatures. When a HTTP request is flagged as malicious, it then sends identified HTTP request to WebRanger console (https://webranger.pandoralabs.net) for evaluation and analysis by a security analyst. NOT ALL/EVERY HTTP request are sent over to the console; only those that were flagged. Depending on your current subscription tier, a security analyst from Pandora's Security Operation Center can validate if this specific request is truly malicious. If it is, there is an option in the WebRanger console to block the specific IP address to prevent any further request from that IP (for paid tiers only). == Technicalities == The WebRanger plugin is composed of two components: the Web Application Intrusion Detection System (WIDS) and the Web Application Firewall (WAF). The WIDS is in charge in scanning the malicious HTTP request and sending them to your WebRanger console. The scanning and detection function of WIDS is based on the open-source project named PHPIDS. For a detailed discussion in how this powerful scanner detects attacks, refer to this link(https://github.com/PHPIDS/PHPIDS). Moreover, WIDS is also in charge in transmitting the malicious request over to your WebRanger console for further consolidation and analysis. The WAF is in charge in blocking or permitting IP addresses from accesing your website. WebRanger maintains a blacklist IP address list in your database. If a blacklisted IP address attempts to enter your website, a 404 Page will be displayed from their browser. Configuring your WAF can be done from your WebRanger console through an API call method. These APIs are securely programmed to only allow you or Pandora SOC personnel to configure your WebRanger plugin from the WebRanger console. For further information about WebRanger, you can visit our website https://www.pandoralabs.net/webranger. == Installation == 1. Install the WebRanger plugin by uploading the ZIP file to the "/wp-content/plugins" directory. 2. Activate the plugin through the 'Plugins' menu option screen in the WordPress Admin console. 3. Go to Settings->WebRanger 4. From here, there are 3 available options in activating your WebRanger plugin to the WebRanger console. (a) If you don't have an existing WebRanger account, choose the option "Register New Account". (b) If you have an existing WebRanger account but have not subscribed to any subscription tier, choose the option "Use Existing Account". (c) If you have an existing WebRanger account and subscribed to any subscription tier, choose option "Use Existing Sensor". 5. If the configuration is successful, a message saying "WebRanger is Currently Active" is displayed in the settings page of the WebRanger plugin. == Frequently Asked Questions == Visit our FAQ Page for a more detailed and updated information (https://pandoralabs.net/webranger/faqs) == Screenshots == 1. The activation page located in the administration panel of WebRanger plugin 2. Successful prompt after the activation of the WebRanger plugin 3. The Dashboard of WebRanger console 4. Another part of the Dashboard of the WebRanger console 5. A single alert being handled by a Pandora SOC personnel == Changelog == = 1.0.0 = * Initial Release of WebRanger Plugin * Comes with WebRanger 1.1.1 == Upgrade Notice == = 1.0.0 = Updated readme.txt and fix screenshots for plugin page. == Features == * Access to WebRanger console and its functionalities * Able to detect and identify malicious HTTP request * Able to block IP addresses (paid tiers) * Able to provide real time detailed events through graphic and detailed charts via WebRanger console (https://webranger.pandoralabs.net)