Snuffleupagus

Snuffleupagus is a PHP7+ and PHP8+ module designed to drastically raise the cost of attacks against websites. This is achieved by killing entire bug classes and providing a powerful virtual-patching system, allowing the administrator to fix specific vulnerabilities without having to touch the PHP code.

Documentation

• Features
  • Bug classes killed or mitigated
  • Exploitation, post-exploitation and general hardening
• Installation
  • Manual installation
  • Heroku installation
  • Upgrading
• Configuration
  • Configuration file format
  • Miscellaneous
  • Bugclass-killer features
  • Virtual-patching
• Download
  • Arch Linux
  • Alpine Linux
  • CloudLinux
  • Debian and Ubuntu
  • Fedora
  • FreeBSD
  • Source code
• Changelog
  • 0.10.0 - Babar the Elephant 2023/09/20
  • 0.9.0 - Elephant seal 2023/01/03
  • 0.8.3 - Elephant Gambit 2022/08/27
  • 0.8.2 - Surus 2022/05/20
  • 0.8.1 - Batyr 2022/05/16
  • 0.8.0 - Woolly Mammoth 2022/05/15
  • 0.7.1 - Proboscidea 2021/08/02
  • 0.7.0 - Los Elefantes 2021/01/02
  • 0.6.0 - Elephant in the room 2020/11/06
  • 0.5.1 - Order of the Elephant 2020/06/20
  • 0.5.0 - Elephant Flats 2019/06/12
  • 0.4.1 - Loxodonta 2018/12/21
  • 0.4.0 - Oliphant Chuckerbutty 2018/08/31
  • 0.3.1 - Elephant Arch 2018/08/20
  • 0.3.0 - Dentalium elephantinum 2018/07/17
  • 0.2.2 - Elephant Moraine 2018/04/12
  • 0.2.1 - Elephant Point 2018/02/07
  • 0.2.0 - Elephant Rally - 2018/01/18
  • 0.1.0 - Mighty Mammoth - 2017/12/21
• FAQ
  • General
  • Installation and configuration
  • Help and support
  • Unimplemented mitigations and abandoned ideas
• Propaganda
  • Talks
  • Mentions
  • Articles
  • Papers
  • Notable users
• Cookies
  • auto_cookie_secure
  • cookie_samesite
  • Cookie encryption

Greetings

We would like to thank the following people:

• Suhosin, for paving the way.
• Hardened PHP, for everything they did, especially the Month of PHP Security.
• The people behind the RIPS scanner, for their ground breaking work
• NBS System, for creating and open-sourcing this piece of software
• Websec.fr, for keeping our interesting vulnerabilities alive
• Web developers around the world, for being so imaginative