⚔️ VGT Sentinel — Community Edition (Silber Status)

"No external libraries. No blind trust. No compromise." AGPLv3 — Open Source Core. Built for humans, not for SaaS margins.

---

⚠️ DISCLAIMER: EXPERIMENTAL R&D PROJECT

This project is a Proof of Concept (PoC) and part of ongoing research and development at VisionGaia Technology. It is not a certified or production-ready product.

Use at your own risk. The software may contain security vulnerabilities, bugs, or unexpected behavior. It may break your environment if misconfigured or used improperly.

Do not deploy in critical production environments unless you have thoroughly audited the code and understand the implications. For enterprise-grade, verified protection, we recommend established and officially certified solutions.

Found a vulnerability or have an improvement? Open an issue or contact us.

---

🧭 Project Direction — Sentinel CE & VGT WP-Desk

VGT Sentinel Community Edition remains the open-source foundation of the VisionGaia security stack.

Starting with the 1.7.x branch, the standalone Sentinel CE repository is treated as a stable open-source core / LTS foundation. Security fixes, compatibility improvements and community contributions remain welcome, but major feature development will increasingly move into the integrated VGT WP-Desk Security Center.

The reason is architectural: Sentinel becomes significantly more powerful when operated together with the broader VGT control layer:

VGT WP-Desk Security Center
├── Sentinel CE / V7        — WAF, IDS, bans, threat logs
├── Throne Guard            — capability hardening, Superkey vault
├── Dattrack                — local telemetry and operational insight
├── Command Center          — diagnostics, runtime state, task management
└── Recovery / Safe Mode    — classic admin fallback and controlled recovery

Sentinel CE will continue to exist as a transparent, forkable and self-hosted security framework for WordPress. Developers, researchers and operators are encouraged to audit, extend and adapt the standalone version for their own environments.

For users who want the full integrated operator experience — including desktop workflow, Security Center, live diagnostics, privilege hardening and local telemetry — we recommend using VGT WP-Desk, where Sentinel is developed as part of a unified WordPress operations and security environment.

In short:

• Sentinel CE Standalone → open-source security core / LTS foundation
• VGT WP-Desk Security Center → actively developed integrated operator platform
• Sentinel V7 → advanced research and next-generation security engine

This project is not abandoned. It is becoming the stable open foundation for the larger VGT WordPress security ecosystem.

| 🖥️ VGT WP-Desk | Operator Desktop / Security Center | Integrated WordPress operations workspace with Sentinel, Throne Guard, Dattrack, diagnostics and recovery controls |

---

📋 Changelog — V1.7.0

🚀 Major Upgrade: AEGIS WAF Engine Reworked

VGT Sentinel 1.7.0 introduces the largest overhaul of the AEGIS engine since the Community Edition launch. The WAF now uses a multi-stage anomaly-scoring architecture with cryptographic browser verification, dramatically reducing false positives while improving detection of heavily obfuscated attacks.

🧠 Anomaly Scoring Engine

• Replaced immediate regex-based blocking with weighted anomaly scoring.

• Every signature now contributes a configurable threat score.

• Requests are blocked only after exceeding the configured threshold_block value.

• Example:

  • sqli = 5 points
  • xss = 5 points
  • rce = 100 points

Benefit: Benign content containing technical keywords no longer triggers immediate visitor lockouts.

---

🔐 Cryptographic JavaScript Challenge

• Added browser verification layer for medium-confidence detections.
• Requests exceeding threshold_challenge receive a JavaScript challenge page.
• Successful browsers receive a signed trust cookie (24h validity).
• Low and medium severity detections are automatically relaxed for verified browsers.

Benefit: Headless bots and scrapers fail automatically while legitimate users experience only a one-time verification step.

---

👨‍💻 Administrator & Editor Relaxation

• Logged-in users with:

  • edit_posts
  • manage_options

  automatically bypass low-risk signatures.

• Weights reduced to zero for:

  • SQLi heuristics
  • XSS heuristics
  • Recon probes
  • Direct DB references
  • GraphQL reconnaissance

• Critical exploit classes remain enforced:

  • RCE
  • LFI
  • Command Injection

Benefit: Content editors can safely work with code snippets, HTML fragments and technical content.

---

🛒 Context-Aware WooCommerce & Gutenberg Protection

WooCommerce:

• Sensitive checkout fields are excluded from inspection:

  • billing_company
  • shipping_company
  • related business fields

Gutenberg:

• Post editing and REST save operations automatically increase challenge/block thresholds.

• Applies to:

  • /wp-json/wp/v2/posts
  • post.php

Benefit: Eliminates false positives during checkout and content publishing.

---

🔬 Enhanced Payload Normalization

Normalization pipeline upgraded:

• Up to 5 recursive URL decode passes
• IIS Unicode %uXXXX support
• Improved nested encoding detection

Benefit: Detects deeply obfuscated payloads and multi-stage encoding bypass attempts.

---

✂️ Intelligent SQL Comment Reconstruction

New lookaround-based comment processing:

• sel/**/ect → select
• select/**/1 → select 1

Benefit: Closes classic SQL comment evasion techniques without breaking syntax reconstruction.

---

⚡ Atomic Signature Refactoring

Large monolithic patterns were split into dedicated detection classes:

Examples:

• rce_eval
• rce_callbacks
• rce_backticks
• rce_jndi_env
• sqli_union
• sqli_select
• xss_script_tags
• xss_event_handlers

Benefits:

• Faster matching
• Better logging
• Lower ReDoS exposure
• Improved diagnostics

---

🏗️ Two-Stage Detection Pipeline

Detection workflow redesigned:

Stage 1:

• Atomic kill signatures
• Immediate critical exploit detection

Stage 2:

• Heuristic scoring
• AI delegation hooks
• Nexus pattern analysis

Benefit: Critical attacks are terminated instantly while reducing CPU usage for normal traffic.

---

🛡️ Hardened Proxy Spoofing Detection

• Added RFC-compliant private and loopback validation.
• Local sockets automatically bypass spoofing checks.
• Improved compatibility with reverse proxies and development environments.

Benefit: Eliminates false positives caused by internal infrastructure.

---

🎨 Improved Challenge UX

New browser verification interface includes:

• Responsive layout
• Corporate branding
• Progress animations
• Mathematical CPU challenge

Benefit: Visitors receive clear feedback instead of a generic HTTP 403 response.

---

🔍 What is VGT Sentinel?

VGT Sentinel Community Edition is the standalone open-source security core of the VGT WordPress ecosystem. For integrated operation, live diagnostics, privilege hardening and local telemetry, Sentinel is also embedded inside the VGT WP-Desk Security Center.

It is the open-source core of the VGT Sentinel suite — a battle-hardened, multi-layered defense system built on a Zero-Trust architecture. Every request is inspected, every header hardened, every upload analyzed, every file hashed and signature-matched, and every bot challenged.

Traditional WordPress Security:
→ Single plugin = single point of failure
→ Shared hosting overhead
→ No outbound control
→ No filesystem integrity monitoring

VGT Sentinel ZTNA Security Stack:
→ Stream-based WAF (AEGIS)             — SQLi, XSS, RCE, LFI neutralized
→ Kernel Hardening (TITAN)             — Server fingerprint masked
→ Stealth Engine (HADES)               — WordPress architecture obfuscated
→ Access Guard (CERBERUS)              — IP-validated brute-force prevention
→ Outbound Control (STYX LITE)         — Data exfiltration blocked
→ Payload Sanitizer (AIRLOCK)          — Binary upload inspection
→ Integrity + Malware Scanner (CHRONOS) — SHA-256 diff + 40+ signatures
→ Anti-Bot Engine (VGT SHIELD)         — Zero-UI PoW bot defense

---

🏛️ Architecture

Incoming HTTP Request
        ↓
CERBERUS (Pre-Auth IP Validation)
→ Cloudflare CIDR verification
→ X-Forwarded-For spoofing prevention
→ Brute-force state via RAM/Object Cache
→ Hook Priority 1 — fires before WP user logic
        ↓
AEGIS WAF (Stream Inspection)
→ php://input scanned in 4KB binary chunks
→ Overlap-buffer for boundary-spanning patterns
→ 512KB scan limit (Memory Exhaustion prevention)
→ Tarpit: Socket-Drop + Connection: Close on critical hit
→ HARDENED V1.6.0: 4-layer payload normalization
        ↓
TITAN (Kernel Hardening)
→ Security headers injected
→ X-Powered-By camouflage (Laravel / Drupal / Django)
→ XML-RPC blocked, REST API locked to auth sessions
→ .env / wp-config.php / .git access denied at .htaccess level
        ↓
HADES (Stealth Engine)
→ URL rewrites mask WordPress directory structure
→ Custom slugs for wp-admin and wp-login.php
        ↓
VGT SHIELD (Anti-Bot / PoW Engine)
→ SHA-256 cryptographic challenge issued by PHP server
→ Web Worker mines proof-of-work in isolated browser thread
→ X-VGT-Shield-PoW header injected into form submissions
→ Server validates hash in <10ms — replay protection (TTL 1800s)
        ↓
AIRLOCK (Upload Inspection)
→ Magic Byte analysis on 4KB header/footer chunks
→ PHP wrapper, Base64 and exec-pattern detection
→ Polyglot file prevention
        ↓
CHRONOS (Integrity + Malware Scanner)  ← UPGRADED IN V1.6.0
→ SHA-256 against integrity_matrix.php baseline
→ mtime + size pre-filter before hash computation
→ NEW: 40+ malware signatures matched on NEW/MODIFIED files only
→ Ghost Trap honeypot triggers IP blacklisting on access
→ Cron-sliced execution (max 20s) — PHP timeout safe
        ↓
STYX LITE (Outbound Control)
→ Telemetry Kill Switch for api.wordpress.org
→ Supply-chain exfiltration blocked

---

🧩 Module Matrix

⚡ 2.1 AEGIS — Web Application Firewall (Hardened V1.6.0)

Stream-based WAF for real-time payload inspection.

Parameter	Value
Engine	Deterministic Regex Pattern Matching (Hardened V1.6.0)
Scan Limit	512 KB (Memory Exhaustion prevention)
Read Strategy	php://input binary stream in 4KB chunks with overlap buffer
Protected Vectors	SQLi, XSS, RCE, LFI, Malicious User Agents
Threat Response	Immediate socket-drop (Connection: Close) before header send
Normalization Layers	URL, HTML Entity, Unicode Escape, Hex Escape
Failure Mode	Fail-Closed PCRE — ReDoS attempts trigger immediate block

V1.6.0 Hardening Summary:

The pattern set was extended to close gaps that gave manual attackers an evasion path. The new normalizer decodes HTML entities (javascript:), Unicode escapes (\u0073ystem), and hex escapes (\x73ystem) before pattern matching — closing four previously distinct evasion vectors at the input layer. The XSS pattern now matches any on* event handler via wildcard instead of a hardcoded list of five. The SQLi pattern accepts non-whitespace separators between OR/AND and operands, closing payloads like 1/OR/1=1 that bypassed the previous whitespace requirement.

---

🔩 2.2 TITAN — Kernel Hardening

Application-layer hardening and server signature masking.

Headers Enforced:
→ X-XSS-Protection
→ X-Frame-Options: SAMEORIGIN
→ X-Content-Type-Options: nosniff
→ Referrer-Policy
→ Permissions-Policy

Camouflage Engine:
→ X-Powered-By spoofed to: Laravel | Drupal | Django

API Lockdown:
→ XML-RPC:     BLOCKED (full)
→ REST API:    Auth-only sessions
→ RSS/Atom:    DISABLED

Protected Paths (.htaccess):
→ .env  |  .git  |  wp-config.php  |  composer.json  |  Vault directories

---