feat: add proxy template origin field and implement socket utilities for log streaming

2026-05-07 10:54:57 +02:00
parent 53dcdafdb1
commit 354ec150bc
32 changed files with 1681 additions and 1214 deletions
@@ -0,0 +1,48 @@
+id: http-block-sqli-markers
+name: Block obvious SQLi markers
+protocol: http
+description: Stops common SQL injection probes before they reach the app.
+category: http
+family: web-hardening
+tags:
+- sqli
+- web
+- block
+action: block
+summary: Stops common SQL injection probes before they reach the app.
+behavior: Matches a short list of high-signal SQLi markers in path, query, and body,
+  then serves a blank HTML page and logs the hit.
+source_url: https://docs.mitmproxy.org/stable/addons/examples/
+code: |
+  import logging
+
+  from mitmproxy import http
+
+  BLOCKED_MARKERS = (
+      "' or 1=1",
+      '" or 1=1',
+      "union select",
+      "sleep(",
+      "information_schema",
+      "--",
+  )
+
+
+  def request(flow: http.HTTPFlow) -> None:
+      body = flow.request.get_text(strict=False)
+      haystack = "\n".join(
+          [flow.request.path, str(flow.request.query), body]
+      ).lower()
+      for marker in BLOCKED_MARKERS:
+          if marker in haystack:
+              logging.warning(
+                  "[http-block-sqli-markers] blocked marker=%r url=%s",
+                  marker,
+                  flow.request.pretty_url,
+              )
+              flow.response = http.Response.make(
+                  200,
+                  b"",
+                  {"content-type": "text/html; charset=utf-8"},
+              )
+              return