OpenRASP is the most popular open-source Runtime Application Self-Protection solution, developed and maintained by the Baidu security team with 3k GitHub stars and 623 forks.

GitHub: baidu/openrasp | Last Release: v1.3.7 (January 2022)

What is OpenRASP?

OpenRASP (Open-source Runtime Application Self-Protection) is a free, open-source security solution that protects applications from attacks at runtime.

It hooks into the application runtime to monitor and block malicious operations.

Unlike commercial RASP solutions, OpenRASP provides core protection capabilities without licensing costs, making it accessible for organizations of all sizes.

Key Features

Plugin-Based Detection

OpenRASP uses a plugin architecture for attack detection:

JavaScript plugins define detection logic
Easy to customize and extend
Community-contributed plugins available

Supported Attack Types

OpenRASP protects against:

SQL injection
Command injection
File operations attacks
XXE (XML External Entity)
SSRF (Server-Side Request Forgery)
Deserialization attacks

Cloud Management Console

OpenRASP includes a management console for:

Centralized policy management
Attack event visualization
Agent status monitoring
Report generation

How It Works

OpenRASP instruments the application runtime using Java Agent technology (for Java) or PHP extensions:

Application Runtime
    └── OpenRASP Agent
            ├── Hooks security-sensitive functions
            ├── Executes JavaScript detection plugins
            └── Blocks or logs malicious operations

Installation

Java Applications

Add the OpenRASP agent to your Java application:

# Download OpenRASP
wget https://github.com/baidu/openrasp/releases/latest/download/rasp-java.tar.gz
tar -xzf rasp-java.tar.gz

# Install to application
java -jar RaspInstall.jar -install /path/to/tomcat

PHP Applications

Install the PHP extension:

# Install extension
phpize
./configure
make && make install

# Add to php.ini
extension=openrasp.so

Configuration

OpenRASP is configured via JSON files:

{
  "block": {
    "status_code": 302,
    "redirect_url": "/blocked.html"
  },
  "inject": {
    "urlprefix": "https://cdn.example.com/openrasp"
  }
}