# Octopus WAF | Web Application Firewall Made In C Language And Use Libevent

**URL:** <https://onehack.st/t/octopus-waf-web-application-firewall-made-in-c-language-and-use-libevent/189920>\
**Category:** Tools & Scripts\
**Tags:** tools, programming\
**Created:** [June 16, 2021, 8:48pm UTC](https://onehack.st/t/octopus-waf-web-application-firewall-made-in-c-language-and-use-libevent/189920 "2021-06-16T20:48:44Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![PlayBoy83](https://onehack.st/user_avatar/onehack.st/playboy83/32/164314_2.png) [@PlayBoy83](https://onehack.st/u/PlayBoy83)\
**Post date:** [June 16, 2021, 8:48pm UTC](https://onehack.st/t/octopus-waf-web-application-firewall-made-in-c-language-and-use-libevent/189920/1 "2021-06-16T20:48:44Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/9/2/92da501fdc7a7bdd3b883ebddd8de3040132fd13.jpeg)

OctopusWAF is a open source Web application firewall, is made in C language uses libevent to make multiple connections.

**First step**

Instal lib-pcre, if you use RPM based distros search pcre-devel package, in BSD based search in ports or brew… Need libevent-dev, on RPM distros libevent-devel, Openssl-dev and openssl-devel.

To compile and run OctopusWAF follow this commands:

```auto
$ git clone https://github.com/CoolerVoid/OctopusWAF$ cd OctopusWAF; make$ bin/OctopusWAFExample tested on DVWA on simple HTTP channel$ bin/OctopusWAF -h 127.0.0.1:2006 -r 127.0.0.1:80 -m horspool --debugOpen your browser in http://127.0.0.1:2006

```

- Notes: Don’t execute with “cd bin; ./OctopusWAF” use full path “bin/OctopusWAF”, because binary need load content in config directory. Use HTTP only for WAF usage, this version 0.1 run TLS but don’t have resource to load cert and read TLS requests/responses, if you use TLS the service can lost WAF function and work like reverse proxy.

Tested on Linux but can run in FreeBSD.

**Code overview**

```auto
-------------------------------------------------------------------------------Language files blank comment code-------------------------------------------------------------------------------C 12 324 138 997C/C++ Header 11 63 70 212make 1 1 0 30Markdown 1 6 0 3-------------------------------------------------------------------------------SUM: 25 394 208 1242-------------------------------------------------------------------------------

```

**TODO:**

Resource to load modsec rules [https://github.com/SpiderLabs/owasp-modsecurity-crs/](https://github.com/SpiderLabs/owasp-modsecurity-crs/)

Insert rules to detect XSS

Insert rules to detect SQLi

Insert rules to detect RCE

Insert rules to detect RFI/LFI

Insert rules to detect XXE

Insert rules to detect Anomalys…

Channel for TLS

Cert Load

**Reference:**

> [https://libevent.org/](https://libevent.org/)

> [https://owasp.org/www-community/Web\_Application\_Firewall](https://owasp.org/www-community/Web_Application_Firewall)

## GitHub:

[https://github.com/CoolerVoid/OctopusWAF](https://github.com/CoolerVoid/OctopusWAF)