diff --git a/CHANGELOG.md b/CHANGELOG.md index 266ca03..017bdb6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,6 +13,7 @@ follow [Semantic Versioning](https://semver.org/) from the first tagged release. - CISA secure-by-design mapping in `docs/assurance.md`, including why monitor mode is the default. ### Changed +- README: screenshots of `logshield check` runs from the lab, as a proof of concept. - README: a plain-language "At a glance" section (what it is, who it is for, how you use it) and common questions. Roadmap: measured results next to the targets, a corrected coverage floor, and an "After 0.1" list. - README: v0.1.0 status, install section (container and release archive), a "What it does not do" section, governance and citation links. `docs/releasing.md` describes the signed-tag, pull-request release flow. - The startup message that says monitor mode does not block is now a warning, so it shows at `-log-level warn`. diff --git a/README.md b/README.md index 006ddc2..9c7c6e5 100644 --- a/README.md +++ b/README.md @@ -226,6 +226,27 @@ payload sits, `-json` prints machine-readable output, `-` reads the payload from standard input, and `-disable-rule` and `-block-suspicious` mirror the proxy. Details: [docs/proxy.md](docs/proxy.md#explaining-a-verdict-logshield-check). +#### Proof of concept + +Real runs of `logshield check` on a Kali Linux VM in the project's +isolated lab. Every payload points at a reserved `.invalid` name, so nothing can +connect anywhere. + +A plain JNDI lookup (exit code `4`), then the same attack hidden behind a nested +`lower` lookup, which a search for the text `jndi` alone would miss: + +![logshield check on a plain and an obfuscated JNDI lookup: both malicious, rules LSH-1001 and LSH-1002](docs/images/check-plain-and-obfuscated.png) + +A percent-encoded payload in a query parameter. The engine decodes the layer a +real web stack would and reports it was "revealed after decoding: percent": + +![logshield check on a percent-encoded payload in a query parameter: malicious, rule LSH-1002, revealed after decoding](docs/images/check-percent-encoded.png) + +JSON output for a script or a pipeline. A bare `env` lookup is only suspicious, +so block mode would let it through and record it unless `-block-suspicious` is set: + +![logshield check -json on an env lookup: decision suspicious, would_block_in_block_mode false, rule LSH-2002](docs/images/check-json-suspicious.png) + ### Options | Flag | Default | Meaning | diff --git a/docs/images/check-json-suspicious.png b/docs/images/check-json-suspicious.png new file mode 100644 index 0000000..a25fd7f Binary files /dev/null and b/docs/images/check-json-suspicious.png differ diff --git a/docs/images/check-percent-encoded.png b/docs/images/check-percent-encoded.png new file mode 100644 index 0000000..89da456 Binary files /dev/null and b/docs/images/check-percent-encoded.png differ diff --git a/docs/images/check-plain-and-obfuscated.png b/docs/images/check-plain-and-obfuscated.png new file mode 100644 index 0000000..7aa4d06 Binary files /dev/null and b/docs/images/check-plain-and-obfuscated.png differ