BeamReactor Intrusion Scanner #

Description #

Security scanning tool that tests direct access to all PHP files in the BeamReactor installation to verify they are properly protected.

Features #

• Recursive Scan: Automatically traverses all directories (modules/, plugins/, rss/, members/)
• Categorisation: Identifies the type of each file (handler, config, library, locale, etc.)
• HTTP Tests: Verifies that direct access correctly returns "forbidden" or 401/403
• Leak Detection: Identifies files that expose content without protection
• Detailed Report: Displays results with HTTP code and response excerpt

Plugin Structure #

plugins/intrusion_scanner/
├── intrusion_scanner.php              # Main interface
├── conf/
│   └── intrusion_scanner.conf.inc.php # Configuration
└── locale/
    └── intrusion_scanner.fr.inc.php   # French translations

Installation #

1. Create the plugins/intrusion_scanner/ directory

2. Copy files into the structure above

3. Access index.php?obj=intrusion_scanner.php (OVERMIND level required)

Usage #

Running a Scan #

1. Access the plugin: ?obj=intrusion_scanner.php

2. Click "Run Scan"

3. Wait for the scan to complete (may take a few minutes)

Interpreting Results #

The scanner classifies files into 4 categories:

✓ Protected Files (Green) #

Files correctly secured that return:

• The text "forbidden"
• HTTP code 401 or 403
• Any other configured denial message

Action: No action required

✗ Vulnerable Files (Red) #

Files that return content (>50 characters) without protection.

URGENT Action: Check each file and add protection:

if(!function_exists('frameheader')) die('forbidden');

? Manual Verification Required (Orange) #

Files with an ambiguous response (short but not "forbidden").

Action: Manually verify each file

⚠ Errors (Red) #

Files that could not be tested (cURL error, timeout, etc.).

Action: Check network configuration and retry

Configuration #

Scanned Directories #

By default:

• modules/
• plugins/
• rss/
• members/

Excluded Directories #

• data/, var/ (data)
• ui/, css/, js/ (assets)
• doc/, sql/, tests/ (dev)
• .git/, node_modules/ (version control)

Excluded Files #

• index.php (legitimate entry point)
• .htaccess
• README.md

Expected Responses #

The scanner considers a file protected if it contains:

• forbidden
• 401
• unauthorized
• access denied
• direct access not permitted

Security #

Access Level #

OVERMIND only: This tool can reveal the internal structure of the system and must be strictly limited to system administrators.

Data Protection #

• Limits the size of captured response (500 characters)
• Does not store complete responses
• 10-second timeout per file

Performance #

• Total timeout: 300 seconds (5 minutes)
• Per-file timeout: 10 seconds
• Progress: Real-time display via JavaScript

Troubleshooting #

Scan does not start #

• Verify you have OVERMIND level
• Verify that cURL is enabled in PHP

All files show errors #

• Check network configuration
• Verify that the web server is accessible locally

False positives #

• Manually verify "ambiguous" files
• Adjust max_response_length if necessary

Recommendations #

After a Scan #

1. Immediately fix all vulnerable files

2. Verify ambiguous files

3. Document legitimate exceptions

4. Re-scan after fixing

Best Practices #

• Run a scan after each plugin addition
• Run a scan after each major update
• Check .htaccess files in sensitive directories

BeamReactor Architecture #

Reminder: No PHP file should be directly accessible

All access goes through index.php:

• members/edit_profile.php → index.php?obj=edit_profile.php
• plugins/mailbox/mailbox.php → index.php?obj=mailbox.php
• modules/handler.mod.php → index.php?obj=handler.mod

Each file must begin with:

if(!function_exists('frameheader')) die('forbidden');

Version #

• Version: 1.0.0
• Date: 2025-12-27
• Author: Treveur Bretaudière

Support #

For any questions or issues, contact the BeamReactor/AEGIS IA team.