* Free WAF for shared hosted website

* Free WAF for shared hosted website
I am looking for free scanning tool for my custom PHP website. As I am using a cheap shared hosting, they are charging me for their security package to have a anti-virus/firewall services.
++++++++++++++
list of top cheapest host http://Listfreetop.pw

Top 200 best traffic exchange sites http://Listfreetop.pw

free link exchange sites list http://Listfreetop.pw
list of top ptc sites
list of top ptp sites
Listfreetop.pw
Listfreetop.pw
+++++++++++++++
Unfortunately my website is not Wordpress, which would helped me to add various free WAF.

If anyone one can recommend a free usable WAF that I can use on my website, without doing commands on the server.

I have tried one called WebCop which is useless. How can I get CWAF working within my website?
As it is a custom PHP site on a shared server, you would need to use a service such as cloudflare, stackpath, etc but their WAFs are paid IIRC. It might be cheaper to upgrade to use the current host's WAF or switch to a provider that has one included.
I am looking for free scanning tool for my custom PHP website.
You can stop looking.

There is no need, as any such tool would be of severely limited benefit for a truly custom site. The "WAF" tools only work because the code they monitor is standardized. A custom site is anything but that.

Your best bet would be to periodically md5 compare the files on the site with the files in your repo. (and of course, look for new php files) If any changed, you'll know it.
"I've seen spam you people wouldn't believe. Routers on fire off the OCs of AGIS. I watched MXes burning in the dark near the Cyberpromo Gateway. All those moments will be lost in time, like tears in rain. TTL=0."
I am looking for free scanning tool for my custom PHP website. As I am using a cheap shared hosting, they are charging me for their security package to have a anti-virus/firewall services.
Unfortunately my website is not Wordpress, which would helped me to add various free WAF.

If anyone one can recommend a free usable WAF that I can use on my website, without doing commands on the server.

I have tried one called WebCop which is useless. How can I get CWAF working within my website?
Your provider do not have any protection for all sites on the server? Did you ask them on this? Or you are using self managed server?
Poor person's Tripwire:

hosting permit
hosting provider lookup
domain 2020
final fantasy 7 make money fast
how to make money on youtube
host mammoth for sale
r domain specific language

Code:
#!/bin/sh

SERIAL=`date +'%Y%m%d'`
cd /some/where/to/save/new/data/

mkdir -p ${SERIAL}

cd ${SERIAL}

lftp -e 'mirror -c httpdocs' -uUSERNAME,PASSWORD ftp://Your.Ftp.Address

find httpdocs -type f -exec md5sum \{\} >> /some/where/to/save/data/${SERIAL}/md5sums \;

diff -iu /some/where/to/save/data/${SERIAL}/md5sums /my/master/data/md5sums > ${SERIAL}.diff || { cat ${SERIAL}.diff | mail -s "Files have changed on ${SERIAL}" [email protected] }
^^ Untested but you should be able to iron out flubs, if any.
"I've seen spam you people wouldn't believe. Routers on fire off the OCs of AGIS. I watched MXes burning in the dark near the Cyberpromo Gateway. All those moments will be lost in time, like tears in rain. TTL=0."
There is no need, as any such tool would be of severely limited benefit for a truly custom site. The "WAF" tools only work because the code they monitor is standardized. A custom site is anything but that. .
So in terms of anti-virus/malware, one should not scan files beyond wordpress, joomla, etc popular scripts because they wont find some code injections? In terms of a WAF, custom sites can still use frameworks, SQL, etc that a WAF would help to protect.
-Steven | u2-web@Cooini, LLC - Business Shared Hosting | Isolate sites with Webspaces | Site Builder | PHP-FPM | MariaDB
WHMCS Modules: Staff Knowledgebase | Custom Modules and Hooks
"It is the mark of an educated mind to be able to entertain a thought without accepting it" -Aristotle
Meant in terms of like server scanner or downloading via ftp as you script does and doing scanning there. Sucuri for exmaple has scanning via ftp but IIRC it is paid . Also, your script presumes a server else where, which if that is the case wouldn't OP just use that server to host? Or perhaps a Linux PC .
Meh - if using a framework sure, at least that portion of the code could be checked - but still limited benefit.

The single best tool for this kind of "spot the hack" monitoring is and was Tripwire, but that won't work on a shared environment since you usually don't get a shell account to play at the command line.

Next best bet would be something like my hacked up script from earler - although after writing it I'd probably change it to only find .php files -- especially if there's lot of media content on the site.

A custom site isn't going to change without user interaction doing it, so something that grabs the current site files, compares them to the "master" copies and reports any discrepancies is all that's really needed. Files that should not exist, or files that have been modified from their originals will be immediately found and reported.
"I've seen spam you people wouldn't believe. Routers on fire off the OCs of AGIS. I watched MXes burning in the dark near the Cyberpromo Gateway. All those moments will be lost in time, like tears in rain. TTL=0."
Meant in terms of like server scanner or downloading via ftp as you script does and doing scanning there. Sucuri for exmaple has scanning via ftp but IIRC it is paid . Also, your script presumes a server else where, which if that is the case wouldn't OP just use that server to host? Or perhaps a Linux PC .
What's stopping anyone from running a little linux box inside a VMWare or VirtualBox VM? Hell you could do this from the BashForWindows linux addon to Windows 10.

... and the reason you would do it from some other machine, preferably your home machine (or Virt) is that your master copies are pretty much guaranteed to be unaltered.
"I've seen spam you people wouldn't believe. Routers on fire off the OCs of AGIS. I watched MXes burning in the dark near the Cyberpromo Gateway. All those moments will be lost in time, like tears in rain. TTL=0."
Poor person's Tripwire:

Code:
#!/bin/sh

SERIAL=`date +'%Y%m%d'`
cd /some/where/to/save/new/data/

mkdir -p ${SERIAL}

cd ${SERIAL}

lftp -e 'mirror -c httpdocs' -uUSERNAME,PASSWORD ftp://Your.Ftp.Address

find httpdocs -type f -exec md5sum \{\} >> /some/where/to/save/data/${SERIAL}/md5sums \;

diff -iu /some/where/to/save/data/${SERIAL}/md5sums /my/master/data/md5sums > ${SERIAL}.diff || { cat ${SERIAL}.diff | mail -s "Files have changed on ${SERIAL}" [email protected] }
^^ Untested but you should be able to iron out flubs, if any.
Where to I run this script from? cPanel, or FTP...
I am too looking for something similar
To answer all the questions at once:

On your home computer, run a Linux virtual machine. This can be done (for free) using VMWare or VirtualBox. If you use Windows 10 you can also enable and use the Bash For Windows add-on to to Windows 10:

https://www.howtogeek.com/249966/how...on-windows-10/

On that virtual machine, or within the Linux environment created by your Windows 10 computer, you would have a master copy of your web site's critical text files (php, html, htaccess etc) That is where you run this script.

It connects to your hosting server, downloads your site's files, and then compares your master files against what it just downloaded and reports any discrepancies found.

It is based upon the same methodology used by Tripwire, so if you're not in a shared environment and have your own dedicated server or VPS, then just use Tripwire instead. As a bonus, Tripwire will monitor your entire OS installation.

https://www.linuxjournal.com/article/8758
"I've seen spam you people wouldn't believe. Routers on fire off the OCs of AGIS. I watched MXes burning in the dark near the Cyberpromo Gateway. All those moments will be lost in time, like tears in rain. TTL=0."